CVE-2026-52805: Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft

June 23, 2026 (updated July 21, 2026)

A Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated user can submit a public URL that redirects to a blocked internal endpoint (e.g., 127.0.0.1), importing the internal repository’s contents into an attacker-controlled repository.

References

github.com/advisories/GHSA-g2f5-gjr4-qjvm
github.com/gogs/gogs/commit/b9a0093e9cd1b2b3c7f42f9feca396dc772c4f1b
github.com/gogs/gogs/pull/8324
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-g2f5-gjr4-qjvm
nvd.nist.gov/vuln/detail/CVE-2026-52805

Code Behaviors & Features

Detect and mitigate CVE-2026-52805 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →