CVE-2026-52802

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description An open redirect issue exists where attacker-controlled redirect to parameters can bypass validation, allowing redirection to arbitrary external sites. This occurs in all redirects validated via the IsSameSite() function, which only inspects the first two characters of the URL string. The check fails to account for directory traversal sequences followed by backslashes (e.g., /a/../example.com). Because web browsers normalize backslashes to forward slashes, the resulting URL becomes a cross-origin redirect. This affects all endpoints using the redirect to query parameter, including login and other post-action flows.

Recommendations Update to version 0.14.3. As a temporary workaround, restrict or sanitize the use of the redirect to parameter in all affected API endpoints until the update is applied.