Yet another RCE in Gogs, but it's fixed this time!

This report details multiple critical vulnerabilities in the Gogs self-hosted Git platform: a path-traversal in organization names that enables creation of bare repositories and, via nested worktrees and Git hooks, Remote Code Execution (CVE-2026-52813); a logic bug in Git HTTP service detection that allows authenticated push bypasses for repos requiring sign-in (CVE-2026-52810); and a stored XSS via an outdated notebookjs renderer for .ipynb files. The authors provide PoCs, an exploit walkthrough demonstrating RCE as the git user, configuration/workarounds and a source patch for the receive-pack check, and advise upgrading or avoiding Gogs until fixes are complete.