CVE-2026-52801

8.1 highEPSS 0.6%

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2026-06-24
Modified: 2026-06-25
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wv27-2vqp-j7g5	Go	gogs.io/gogs	<0.14.3	0.14.3
GO-2026-5724	Go	gogs.io/gogs	all versions	no fix published

References

https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c
https://github.com/gogs/gogs/pull/8225
https://github.com/gogs/gogs/releases/tag/v0.14.3
https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5
https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5

Check your stack JSON