high8.8

CVE-2026-26194

Gogs: Release tag option injection in release deletion

Impact

### Summary There is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process. ### Affected Component - internal/database/release.go `process.ExecDir(..., "git", "tag", "-d", rel.TagName)` ### Details `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`. If the tag name begins with `-`, Git parses it as a flag. The prior mitigation is incomplete. There is path sanitization in place during creation: - internal/database/release.go `r.TagName = strings.TrimLeft(r.TagName, "-")` But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates. **Exploit Conditions** 1. An attacker can add a tag name that starts with a dash into the repository. 2. A user with permission to delete releases triggers it through the web UI or API. ### Recommended Fix 1. Add end-of-options in release deletion: - `git tag -d -- <tagName>` 2. It is better to use the safe git-module deletion helper since it handles options properly. 3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used. ### Impact - Option injection into `git tag -d` - Tag/release deletion can fail or behave unexpectedly - Operational denial of service in release cleanup workflows - Potential release metadata inconsistency

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`gogs.io/gogs`	<= 0.14.1	0.14.2

Affected products

Vendor	Product	Affected versions
Gogs	Gogs	before 0.14.2

Weakness classification

CWE-88

Impact

Affected packages

Affected products

Weakness classification

References