---
id: CVE-2026-52801
title: Gogs has the ability to import local repositories via Mirror Settings
summary: Gogs has the ability to import local repositories via Mirror Settings
severity: high
cvss: 8.1
cwe:
  - CWE-20
vendor: gogs
product: gogs.io/gogs
ecosystem: go
affected:
  - gogs.io/gogs < 0.14.3
patched:
  - gogs.io/gogs 0.14.3
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wv27-2vqp-j7g5'
references:
  - url: 'https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5'
  - url: 'https://github.com/gogs/gogs/pull/8225'
  - url: >-
      https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c
  - url: 'https://github.com/gogs/gogs/releases/tag/v0.14.3'
  - url: 'https://github.com/advisories/GHSA-wv27-2vqp-j7g5'
tags:
  - ghsa
  - go
epss: 0.00569
epssPercentile: 0.45872
ingestedAt: '2026-06-29T13:24:35.479Z'
---

## Overview

### Summary
The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.

### Details
Here is the function implementation of the secure New Migration functionality.
<img width="1200" height="755" alt="image" src="https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96" />

Here is the function implementation of the Mirror Settings without any validation.
<img width="1200" height="477" alt="image" src="https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7" />

### PoC
The New Migration feature correctly blocked my attempt to import a local repository.
<img width="1200" height="1008" alt="image" src="https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e" />

But if I create a normal migration with a valid repository.
<img width="1200" height="1006" alt="image" src="https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac" />

Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository.
<img width="1200" height="476" alt="image" src="https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7" />

Here is the result after the sync.
<img width="1200" height="533" alt="image" src="https://github.com/user-attachments/assets/1df76642-3e55-4493-a422-f7f0619b463d" />


### Impact
Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.

## Affected packages

- `gogs.io/gogs < 0.14.3`

## Remediation

Upgrade to a patched release:

- `gogs.io/gogs 0.14.3`