CVE-2026-52802 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites. All redirects in Gogs that are validated via the IsSameSite function are vulnerable. The function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. This vulnerability is fixed in 0.14.3.
An open redirect vulnerability has been identified in Gogs, an open-source self-hosted Git service, in versions prior to 0.14.3. The issue arises because the `redirect_to` query parameter can be manipulated to bypass validation, allowing redirection to arbitrary external sites. This vulnerability affects all redirects validated by the `IsSameSite` function, which only checks the first two characters of the URL. The flawed validation fails to recognize directory traversal sequences followed by backslashes, enabling attackers to craft links that exploit this oversight.
Users can upgrade to Gogs version 0.14.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8322 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | <= 0.14.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |