8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52805

CVE-2026-52805: Gogs: Migration Redirect Bypass Leads to Internal Repository Theft

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated user can submit a public URL that redirects to a blocked internal endpoint (e.g., 127.0.0.1), importing the internal repository's contents into an attacker-controlled repository. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52805

CVE-2026-52805:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the repository migration and mirroring functionality of Gogs. The root cause is that the application validates the user-provided remote URL at the beginning of the process, but the underlying git clone and git remote update commands were configured to follow HTTP redirects. An attacker could provide a seemingly benign public URL which, upon being accessed by the Gogs server, would redirect to a blocked internal IP address (e.g., 127.0.0.1). This would cause the git process to clone or sync from the internal repository, effectively bypassing the security controls designed to prevent access to local and private network resources.

The patch addresses this by introducing a new function, mirrorGitArgs, which returns the git command-line argument -c http.followRedirects=false. This argument is then consistently applied to all git commands that interact with remote repositories, specifically in the MigrateRepository and runSync functions. By disabling HTTP redirects at the git level, the application ensures that even if a redirect is encountered, it will not be followed, thus mitigating the SSRF vulnerability.

Vulnerable functions

MigrateRepository

internal/database/repo.go

This function is responsible for migrating a repository from a remote URL. It was vulnerable because it used `git clone` which, by default, follows HTTP redirects. An attacker could provide a valid public URL that redirects to an internal service, bypassing the initial URL validation and causing an SSRF. The fix disables this behavior.

runSync

internal/database/mirror.go

This function syncs a mirrored repository. It was also vulnerable to the same SSRF attack as `MigrateRepository`. If the mirrored repository's remote URL was changed to a redirecting URL, it could be used to access internal resources. The patch applies the same fix of disabling redirects.

wikiRemoteURL

internal/database/repo.go

This function determines the remote URL for a repository's wiki. It was vulnerable because it would check for the existence of a wiki by trying to access a URL, and the underlying check followed redirects. This could be abused to scan internal networks. The fix is to use a check that does not follow redirects.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.