CVE-2026-52802

Summary

Gogs has an Open Redirect via redirect_to

Severity

medium

CVSS

5.4

EPSS

0.6% (p44)

CWE

CWE-601

Also known as

GHSA-xxhq-69mf-w8cr

Published

2026-06-23

Updated

2026-06-23

Advisory details

Summary

An open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites.

Details

All redirects in Gogs that are validated via the IsSameSite function are vulnerable:

func IsSameSite(url string) bool {
    return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\'
}

The function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. For example:

/a/../\example.com

The IsSameSite function checks the input supplied to the redirect_to query parameter value /a/../\example.com and considers it valid.

Because web browsers normalize backslashes \ to forward slashes /, the normalized URL becomes //example.com.

The normalized URL becomes:

//example.com

Resulting in a cross-origin redirect.

This affects all endpoints using the redirect_to query parameter, including login and other post-action flows.

PoC

1. An attacker can provide a user with a link to login to Gogs with a redirect_to query parameter that redirects a user to a site the attacker wants them to visit:

http://192.168.236.132:3000/user/login?redirect_to=/a/../\example.com

2. After the user successfully logs in, they would be redirected to the site an attacker wants them to visit:

Impact

• Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
• OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
• Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
• Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

References

• https://github.com/advisories/GHSA-xxhq-69mf-w8cr
• https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr
• https://github.com/gogs/gogs/pull/8322
• https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f
• https://github.com/gogs/gogs/releases/tag/v0.14.3

Related advisories

• CVE-2026-52813 — critical · Go/gogs.io/gogs
• CVE-2026-52811 — critical · Go/gogs.io/gogs
• CVE-2026-52806 — critical · Go/gogs.io/gogs
• CVE-2026-52812 — high · Go/gogs.io/gogs
• CVE-2026-52810 — high · Go/gogs.io/gogs
• CVE-2026-52808 — high · Go/gogs.io/gogs
• CVE-2026-52807 — high · Go/gogs.io/gogs
• CVE-2026-52805 — high · Go/gogs.io/gogs

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity