【高危】gogs：服务端请求伪造风险（GHSA-wv27-2vqp-j7g5）

安全情报快照 · 风险级别：高危 · CVSS：8.1 · CVE-2026-52801 · GHSA-wv27-2vqp-j7g5

先看结论

gogs存在服务端请求伪造风险，< 0.14.3 受影响，建议升级至 0.14.3。

影响范围

生态	组件	受影响版本	首个修复版本
go	`gogs.io/gogs`	< 0.14.3	0.14.3

处置建议

优先将 gogs.io/gogs 升级至 0.14.3 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.

Details

Here is the function implementation of the secure New Migration functionality.

Here is the function implementation of the Mirror Settings without any validation.

PoC

The New Migration feature correctly blocked my attempt to import a local repository.

But if I create a normal migration with a valid repository.

Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository.

Here is the result after the sync.

Impact

Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。