CVE Explorer
CVE-2026-52802
Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites. All redirects in Gogs that are validated via the IsSameSite function are vulnerable. The function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. This vulnerability is fi
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"gogs","vendor":"gogs","versions":[{"status":"affected","version":"< 0.14.3"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f","tags":["x_refsource_MISC"],"url":"https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/references/2
{"name":"https://github.com/gogs/gogs/pull/8322","tags":["x_refsource_MISC"],"url":"https://github.com/gogs/gogs/pull/8322"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/references/1
{"name":"https://github.com/gogs/gogs/releases/tag/v0.14.3","tags":["x_refsource_MISC"],"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/references/3
{"name":"https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7074f115c42c4970846b5b2b6d244fd83c6a526464b781b885f6d960be4cc021 · sha256:59aca83248507bae… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.