CVE-2026-52805 gogs CVE debrief

Who should care

Defenders responsible for Gogs instances, especially those with user authentication and repository migration functionalities, should assess their exposure to this vulnerability and prioritize remediation.

Why it matters

CVE-2026-52805 is a high-severity SSRF vulnerability in Gogs that allows authenticated users to import internal repository contents. Defenders should verify exposure, prioritize remediation, and assess user authentication and repository migration settings.

• Potential unauthorized access to internal repository contents
• Possible data exfiltration through repository imports
• Risk of lateral movement within the network
• Need for verification of user authentication and repository settings

Technical summary

The Gogs application validates only the initially submitted URL hostname during repository migration, but git clone --mirror follows HTTP redirects. This allows an authenticated user to submit a public URL that redirects to a blocked internal endpoint, potentially importing internal repository contents into an attacker-controlled repository. The vulnerability is due to the lack of proper validation of HTTP redirects during the repository migration process. This could lead to unauthorized access to internal repositories and potential data exfiltration. The fix in version 0.14.3 addresses this issue by properly handling HTTP redirects during repository migration.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability in their Gogs instances, especially if they have not upgraded to version 0.14.3. They should assess their deployment context, focusing on user authentication and repository migration functionalities.

Recommended defensive actions

• Verify Gogs instance version and upgrade to 0.14.3 if necessary
• Assess user authentication and repository migration settings
• Monitor repository imports for suspicious activity
• Review and update incident response plans for potential SSRF exploitation
• Perform a thorough review of Gogs instance configurations and user permissions
• Implement additional monitoring for internal repository access and data exfiltration attempts
• Conduct a security audit to identify and address any existing repository imports from untrusted sources

Evidence notes

The vulnerability is confirmed to exist in Gogs versions prior to 0.14.3. The fix is provided in version 0.14.3. However, the exact scope of affected deployments and potential impact require further verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.