SSRF in repository migration in gogs.io/gogs

Description

References

• gogs/gogs security advisory · ADVISORY
• huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 · WEB

More vulnerabilities in gogs.io/gogs

• GO-2026-5193Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
• CVE-2026-52816MEDIUM 5.4Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipy…
• CVE-2026-52815MEDIUM 5.5Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /…
• CVE-2026-52814MEDIUM 5.5Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymme…
• CVE-2026-52813CRITICAL 10.0Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted b…