CVE-2026-52801 json
Gogs: Ability to import local repositories via Mirror Settings
published 4mo ago modified 3mo ago also EUVD-2026-39070 , GHSA-wv27-2vqp-j7g5 , GO-2026-5724
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.
Patch / fix
- go gogs.io/gogs 0.14.3
- gogs gogs 0.14.3
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/gogs/gogs@11e19f2 commit
- github.com/gogs/gogs#8225 pull request
- github.com/gogs/gogs/releases/tag/v0.14.3 release
Is CVE-2026-52801 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | gogs.io/gogs | <0.14.3 all versions |
0.14.3 |
Affected products
- gogs gogs
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/gogs/gogs/pull/8225
web
-
github.com
/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c
web
-
github.com
/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5
exploit, web, advisory
-
github.com
/gogs/gogs/releases/tag/v0.14.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-52801
advisory
-
github.com
/gogs/gogs
package
Sources
- CVE List CVE-2026-52801
- GitHub Advisory GHSA-wv27-2vqp-j7g5
- NVD CVE-2026-52801
- OSV GO-2026-5724
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.