CVE-2026-52801

Published: Jun 24, 2026Modified: Jun 25, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (5)

https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c

Source: security-advisories@github.com

https://github.com/gogs/gogs/pull/8225

Source: security-advisories@github.com

https://github.com/gogs/gogs/releases/tag/v0.14.3

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.