CVE-2026-52801

Summary

Gogs has the ability to import local repositories via Mirror Settings

Severity

high

CVSS

8.1

EPSS

0.6% (p45)

CWE

CWE-20

Also known as

GHSA-wv27-2vqp-j7g5

Published

2026-06-23

Updated

2026-06-23

Advisory details

Summary

The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.

Details

Here is the function implementation of the secure New Migration functionality.

Here is the function implementation of the Mirror Settings without any validation.

PoC

The New Migration feature correctly blocked my attempt to import a local repository.

But if I create a normal migration with a valid repository.

Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository.

Here is the result after the sync.

Impact

Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.

References

• https://github.com/advisories/GHSA-wv27-2vqp-j7g5
• https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5
• https://github.com/gogs/gogs/pull/8225
• https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c
• https://github.com/gogs/gogs/releases/tag/v0.14.3

Related advisories

• CVE-2026-52813 — critical · Go/gogs.io/gogs
• CVE-2026-52811 — critical · Go/gogs.io/gogs
• CVE-2026-52806 — critical · Go/gogs.io/gogs
• CVE-2026-52812 — high · Go/gogs.io/gogs
• CVE-2026-52810 — high · Go/gogs.io/gogs
• CVE-2026-52808 — high · Go/gogs.io/gogs
• CVE-2026-52807 — high · Go/gogs.io/gogs
• CVE-2026-52805 — high · Go/gogs.io/gogs

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity