Executive brief
Gogs, a self-hosted Git service, is vulnerable to a security flaw in its repository migration and mirroring features. An authenticated user can trick the system into connecting to internal company servers that should be private. This could allow an attacker to steal sensitive internal data or access private services by importing their contents into a public-facing repository.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gogs' repository migration and mirror synchronization logic. While Gogs validates the initial URL hostname against a blocklist, the underlying 'git clone --mirror' command follows HTTP redirects without re-validating the new destination. Additionally, the recurring mirror sync failed to re-validate hostnames, allowing an attacker to bypass initial checks via DNS rebinding or by changing a benign URL to redirect to an internal endpoint (e.g., 127.0.0.1) after the mirror was established. This allows an authenticated attacker to import contents from internal-only services into an attacker-controlled repository. The fix in version 0.14.3 disables HTTP redirects for git operations and implements mandatory hostname re-validation before every sync.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-05: patched: Fix committed to main branch.
- 2026-06-07: advisory: Release v0.14.3 published.
- 2026-06-24: disclosed: CVE-2026-52805 published.