8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52801

CVE-2026-52801: Gogs: Ability to import local repositories via Mirror Settings

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52801

CVE-2026-52801:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-wv27-2vqp-j7g5, allows an authenticated user to import local repositories by bypassing validation in the Mirror Settings of a repository. The root cause is improper input validation in the repo.SettingsPost function, located in internal/route/repo/setting.go.

Analysis of the patch commit 11e19f28b5c82466fd1689c94344ef4313ee986c reveals that the SettingsPost function, which handles the POST request for updating repository settings, did not validate the MirrorAddress field before saving it. The vulnerable code directly passed the user-provided address to c.Repo.Mirror.SaveAddress(). This allowed an attacker to specify a local file system path, leading to a server-side request forgery (SSRF) vulnerability and allowing access to local repositories that the git user has access to.

The fix involves adding a call to the form.ParseRemoteAddr function to validate the MirrorAddress before it is passed to SaveAddress. This is the same validation function used in the secure repository migration feature, which correctly prevents the use of local paths.

Therefore, two key functions would appear in a runtime profile during exploitation:

repo.SettingsPost: The entry point of the vulnerability, which receives the malicious input.
db.(*Mirror).SaveAddress: The function that consumes the malicious input, leading to the vulnerable behavior.

The primary vulnerable function is repo.SettingsPost due to the missing validation. db.(*Mirror).SaveAddress is a runtime indicator as it's part of the exploitation path.

Vulnerable functions

repo.SettingsPost

internal/route/repo/setting.go

This function is the HTTP handler for updating repository settings. The vulnerability lies in the fact that it previously took the `MirrorAddress` directly from the user's form input and passed it to `c.Repo.Mirror.SaveAddress` without any validation. This allowed an authenticated user to set a local file path as the mirror address, bypassing security controls. The patch introduces a call to `form.ParseRemoteAddr` to validate the address before it is saved.

db.(*Mirror).SaveAddress

internal/db/mirror.go

This function is called by `repo.SettingsPost` to save the mirror address. While not inherently vulnerable, it is the function that receives the unvalidated, potentially malicious local path from the user. A runtime profiler would show this function being called as part of the exploit chain. The vulnerability is that its caller, `repo.SettingsPost`, did not validate the input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.