Executive brief
Gogs is an open-source self-hosted Git service used by organizations to manage source code. A security flaw in the repository mirror settings allows logged-in users to bypass security restrictions and access local files on the server or probe internal network resources. This could lead to the exposure of sensitive source code or unauthorized access to internal company systems.
Technical details
A vulnerability in the 'SaveAddress' function within Gogs Mirror Settings allows for a validation bypass. While the initial 'New Migration' workflow correctly validates repository URLs, the update path for existing mirrors fails to enforce the same checks, such as protocol whitelisting and local network address blocking. An authenticated attacker can exploit this by first creating a legitimate mirror and then updating the address to use the 'file://' protocol to read local repositories or internal network addresses (SSRF). This issue is classified as improper input validation (CWE-20) and is resolved in version 0.14.3 by unifying the validation logic across both creation and update paths.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-04-04: other: Pull request submitted to fix the validation bypass
- 2026-06-07: patched: Version 0.14.3 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE-2026-52801 published to NVD