#self-hosted-git

Analysis · May 29, 2026 · Colten Anderson

Gogs has a critical RCE and no one is coming to fix it

Rapid7 found a push-button remote code execution flaw in Gogs, shipped a Metasploit module with it, and ran 72 days from report to publication with no patch and two months of maintainer silence. There is no fix. There may never be one.