CVE-2026-82402
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Gogs prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative external URL, allowing links on a trusted Gogs domain to redirect victims to attacker-controlled content for phishing. This vulnerability is fixed in 0.15.0+dev.
Risk Assessment
An attacker can abuse the trusted Gogs domain to redirect users to malicious sites, facilitating phishing and credential theft.
Recommendation
Upgrade Gogs to version 0.15.0+dev or later; until then, warn users about suspicious redirects from the Gogs instance.
Other vulnerabilities in Gogs
See all- CVE-2025-8110HighActively exploited
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
- CVE-2026-52816Medium
Gogs is an open source Git service that prior to version 0.14.3 had a vulnerability in the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb. This vulnerability allowed arbitrary data URIs to be submitted without proper restrictions, potentially leading to Cross-Site Scripting (XSS) attacks.
- CVE-2026-52815Medium
Gogs, an open source Git service, prior to version 0.14.3 has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication.
- CVE-2026-52810High
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorized POST …/git-receive-pack using the client-supplied service query string, allowing push where only read should be allowed.
- CVE-2026-52802Medium
Gogs is an open source Git service that prior to version 0.14.3 had an open redirect vulnerability. Attacker-controlled redirect_to parameters could bypass validation, allowing redirection to arbitrary external sites.
- CVE-2026-52799High
Gogs is an open source Git service that prior to version 0.14.3 allowed downloading attachments without verifying user permissions. Unauthenticated users could download attachments from private repositories.
- CVE-2026-52798High
Gogs is an open-source Git service that prior to version 0.14.3 had a vulnerability allowing the execution of malicious JavaScript code. Although .ipynb previews were sanitized on the server side, their content was re-rendered on the client side without proper sanitization, leading to the possibility of XSS attacks.
- CVE-2026-52797High
Gogs is an open source Git service that, prior to version 0.14.0, allowed authorized users to manipulate the value passed to the git diff command. This enabled users to bypass filtering and write the comparison result to any arbitrary location.
- CVE-2026-52796Low
Gogs is an open source Git service that prior to version 0.14.3 was vulnerable to a panic error when rendering a specially crafted issue index pattern, resulting in denial of service.
- CVE-2026-52795Medium
Gogs is an open-source Git service that in version 0.14.3 and earlier allows authenticated users to watch private repositories they do not have access to. The issue arises from an incorrectly implemented access check in the Watch API, enabling attackers to access information from private repositories.
Original NVD description (English source)
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative external URL, allowing links on a trusted Gogs domain to redirect victims to attacker-controlled content for phishing. This vulnerability is fixed in 0.15.0+dev.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS