{"id":"CVE-2026-52801","title":"Gogs has the ability to import local repositories via Mirror Settings","summary":"Gogs has the ability to import local repositories via Mirror Settings","severity":"high","cvss":8.1,"cwe":["CWE-20"],"vendor":"gogs","product":"gogs.io/gogs","ecosystem":"go","affected":["gogs.io/gogs < 0.14.3"],"patched":["gogs.io/gogs 0.14.3"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wv27-2vqp-j7g5","references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5"},{"url":"https://github.com/gogs/gogs/pull/8225"},{"url":"https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c"},{"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3"},{"url":"https://github.com/advisories/GHSA-wv27-2vqp-j7g5"}],"tags":["ghsa","go"],"epss":0.00569,"epssPercentile":0.45622,"ingestedAt":"2026-06-29T13:24:35.479Z","slug":"CVE-2026-52801","body":"## Overview\n\n### Summary\nThe Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.\n\n### Details\nHere is the function implementation of the secure New Migration functionality.\n<img width=\"1200\" height=\"755\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96\" />\n\nHere is the function implementation of the Mirror Settings without any validation.\n<img width=\"1200\" height=\"477\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7\" />\n\n### PoC\nThe New Migration feature correctly blocked my attempt to import a local repository.\n<img width=\"1200\" height=\"1008\" alt=\"image\" src=\"https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e\" />\n\nBut if I create a normal migration with a valid repository.\n<img width=\"1200\" height=\"1006\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac\" />\n\nThen, I could use the Mirror Settings feature under the Repository Settings sync a local repository.\n<img width=\"1200\" height=\"476\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7\" />\n\nHere is the result after the sync.\n<img width=\"1200\" height=\"533\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1df76642-3e55-4493-a422-f7f0619b463d\" />\n\n\n### Impact\nUsers can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.\n\n## Affected packages\n\n- `gogs.io/gogs < 0.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gogs.io/gogs 0.14.3`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}