Executive brief
Gogs is an open-source self-hosted Git service. A security flaw in how the service handles large files (Git LFS) allows a user with write access to any repository to gain unauthorized access to private files in other repositories. By claiming to upload a file that already exists in a private repository, an attacker can trick the system into giving them a copy of that file, potentially leading to the exposure of sensitive intellectual property or secrets.
Technical details
Gogs uses content-addressed storage for Git LFS objects, where files are stored based on their OID (hash). Prior to version 0.14.3, the 'serveUpload' function implemented a deduplication shortcut: if an OID already existed on disk, the server would skip the upload and create a new database entry linking the current repository to that OID without verifying that the uploaded data actually matched the OID. An attacker with write access to any repository can exploit this by initiating an LFS upload for a known OID belonging to a private repository. Because the server fails to validate the request body against the OID during this 'dedupe' path, the attacker can establish a valid authorization link to the private object and subsequently download it through their own repository's LFS endpoint. This has been fixed in version 0.14.3 by enforcing hash verification on all upload paths.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-07: patched: Fixed in version 0.14.3
- 2026-06-24: disclosed: CVE-2026-52812 published