Summary The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of val…
| CVE ID | CVE-2026-52801 |
| Vendor | go |
| Affected Product | gogs.io/gogs |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.1 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.
Here is the function implementation of the secure New Migration functionality. Here is the function implementation of the Mirror Settings without any validation.
The New Migration feature correctly blocked my attempt to import a local repository. But if I create a normal migration with a valid repository. Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository. Here is the result after the sync.
Users can import local repositories from the server's filesystem, whic
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.