CVE-2026-47267

Published: Jun 24, 2026Modified: Jun 25, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.7

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/gogs/gogs/commit/199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018

Source: security-advisories@github.com

https://github.com/gogs/gogs/pull/8263

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.