CVE-2026-52801

EUVD-2026-39070
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gogsgogs
𝑥
< 0.14.3
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c
https://github.com/gogs/gogs/pull/8225
https://github.com/gogs/gogs/releases/tag/v0.14.3
https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5
https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5