CVE-2026-52802 Gogs: Open Redirect via redirect_to in Gogs
Attackers can redirect users to arbitrary external sites via flawed URL validation in Gogs, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52802?
CVE-2026-52802 is a medium-severity vulnerability in gogs, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites. All redirects in Gogs that are validated via the IsSameSite function are vulnerable. The function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. This vulnerability is fixed in 0.14.3.
Weakness: CWE-601
Which versions are affected by CVE-2026-52802?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.3 |
gogs.io/gogs Go | All versions | 0.14.3 |
How do I fix CVE-2026-52802?
Upgrade gogs.io/gogs to 0.14.3 or later.
Is CVE-2026-52802 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52802 exists.
Sources
Also known as GHSA-xxhq-69mf-w8cr, GO-2026-5773.