PT-2026-51459 · Go · Gogs.Io/Gogs
Published
2026-06-23
·
Updated
2026-06-23
·
CVE-2026-52801
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Summary
The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.
Details
Here is the function implementation of the secure New Migration functionality.
Here is the function implementation of the Mirror Settings without any validation.
PoC
The New Migration feature correctly blocked my attempt to import a local repository.
But if I create a normal migration with a valid repository.
Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository.
Here is the result after the sync.
Impact
Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gogs.Io/Gogs