EUVD-2026-39070
GHSA-wv27-2vqp-j7g5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Network-reachable web UI, low-priv authenticated user, no UI; high confidentiality from local repo read, low availability from SSRF/mirror noise, no integrity impact.
Primary rating from Vendor (https://github.com/gogs/gogs).
CVSS VectorVendor: https://github.com/gogs/gogs
Lifecycle Timeline
2DescriptionCVE.org
Summary
The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.
Details
Here is the function implementation of the secure New Migration functionality. <img width="1200" height="755" alt="image" src="https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96" />
Here is the function implementation of the Mirror Settings without any validation. <img width="1200" height="477" alt="image" src="https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7" />
PoC
The New Migration feature correctly blocked my attempt to import a local repository. <img width="1200" height="1008" alt="image" src="https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e" />
But if I create a normal migration with a valid repository. <img width="1200" height="1006" alt="image" src="https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac" />
Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository. <img width="1200" height="476" alt="image" src="https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7" />
Here is the result after the sync. <img width="1200" height="533" alt="image" src="https://github.com/user-attachments/assets/1df76642-3e55-4493-a422-f7f0619b463d" />
Impact
Users can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.
AnalysisAI
Local repository import and blind SSRF in Gogs versions prior to 0.14.3 allows authenticated users to bypass clone-address validation via the Mirror Settings feature. The SaveAddress path in repository Mirror Settings omitted the validation applied to New Migration, letting any authenticated user point a mirror at a local filesystem path or internal address. No public exploit identified at time of analysis beyond the reporter's PoC; not listed in CISA KEV.
Technical ContextAI
Gogs is a self-hosted Go-based Git service (CPE pkg:go/gogs.io_gogs). The vulnerable code path is in internal/route/repo/setting.go where SettingsPost called c.Repo.Mirror.SaveAddress(f.MirrorAddress) directly, while the New Migration path went through MigrateRepo.ParseRemoteAddr which enforced CanImportLocal() checks and blocked-local-address validation. Root cause is CWE-20 (Improper Input Validation): a duplicated input sink that did not reuse the central ParseRemoteAddr validator, so URL/path/permission/blocked-address checks were skipped on mirror updates.
RemediationAI
Vendor-released patch: upgrade Gogs to 0.14.3 or later (https://github.com/gogs/gogs/releases/tag/v0.14.3), which routes Mirror Settings through the same ParseRemoteAddr validator used by New Migration (PR https://github.com/gogs/gogs/pull/8225, commit 11e19f28b5c82466fd1689c94344ef4313ee986c). If immediate upgrade is not possible, set IMPORT_LOCAL_PATHS=false in app.ini and ensure no user account has CanImportLocal privileges, restrict who can create repositories and edit mirror settings to trusted users only, place Gogs behind a network egress policy that blocks RFC1918 and link-local addresses to limit blind SSRF, and consider temporarily disabling the mirror feature in the UI by reverse-proxy rules on /<owner>/<repo>/settings if mirroring is not required; the trade-off is loss of legitimate mirroring functionality and tighter user-management overhead.
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today