CVE-2026-52805

Name of the Vulnerable Software and Affected Versions Gogs (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) issue exists in the repository migration functionality. The application validates the hostname of the initially submitted URL against a blocklist of local and private-network addresses using the ParseRemoteAddr() function in internal/form/repo.go. However, the migration process utilizes git clone --mirror in internal/database/repo.go, which follows HTTP redirects without revalidating the final target. An authenticated user can provide a public URL that redirects to a blocked internal endpoint, such as 127.0.0.1, allowing the import of internal repository contents into an attacker-controlled repository. This can lead to the theft of source code and secrets from internal repositories served over HTTP or the scanning of internal network services via the '/api/v1/repos/migrate' endpoint using the clone addr parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.