CVE-2026-47267

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description An issue exists where webhooks follow redirects, allowing access to hostnames within localCIDRs (Internet Protocol address ranges used for local networks). This leads to Server Side Request Forgery (SSRF), a flaw where an attacker can induce the server-side application to make requests to an unintended location. An attacker can achieve this by creating a webhook pointing to a URL that returns an HTTP 301 redirect to a local address, such as 'http://169.254.169.254/metadata/v1.json'.

Recommendations Update to version 0.14.3.