CVE-2026-52802: Gogs Open Redirect Vulnerability (v0.14.2 and Earlier)

Technical summary

CVE-2026-52802 is an open redirect vulnerability (CWE-601) in Gogs prior to version 0.14.3. The root cause is a flawed implementation of the IsSameSite validation function, which performs an insufficient check by only inspecting the first two characters of the redirect_to parameter. This allows attackers to craft URLs containing directory traversal sequences (such as '../' or '..\') followed by backslashes that evade validation logic, enabling redirection to attacker-controlled external domains. The vulnerability requires user interaction—a victim must click on or be redirected via a specially crafted link—but once triggered, the redirect occurs without additional security prompts.

Business impact

Open redirect vulnerabilities are commonly exploited in phishing and credential harvesting campaigns. An attacker can leverage a Gogs instance to create seemingly legitimate links that appear to direct users to internal resources but actually redirect them to lookalike login pages or malware distribution sites. For organizations self-hosting Gogs, this creates a trust problem: users may assume links from the Gogs interface are safe. The medium CVSS score (5.4) reflects the requirement for user interaction, but the reputational and phishing risk should not be underestimated, especially if the Gogs instance is used by a development team or hosts sensitive project links.

Affected systems

All Gogs instances running version 0.14.2 and earlier are affected. Self-hosted Gogs deployments in enterprises, open-source projects, or development teams are in scope. The vulnerability affects any functionality within Gogs that uses the IsSameSite function for redirect validation, meaning multiple redirect endpoints across the application are at risk, not just a single feature.

Exploitability

Exploitability is moderate. An attacker cannot directly force a redirect; user interaction is required. However, the attack surface is broad—any link within Gogs that performs a redirect is a potential vector. Attackers can embed malicious links in issue descriptions, pull request comments, commit messages, or other user-generated content within Gogs itself, leveraging the platform's own interface to distribute phishing links. The vulnerability does not require authentication, making it accessible to unauthenticated users if Gogs is configured with public repositories or accessible registration.

Remediation

Upgrade Gogs to version 0.14.3 or later immediately. This version includes a corrected IsSameSite validation function that properly handles directory traversal sequences and backslash evasion attempts. Verify the upgrade against the official Gogs release notes and repository to confirm the patch is applied. For organizations that cannot upgrade immediately, consider implementing a Web Application Firewall (WAF) rule to detect and block redirect_to parameters containing directory traversal patterns, and educate users about validating URLs before clicking links from Gogs.

Patch guidance

1. Review your current Gogs version via the admin console or by checking the installed release tag. 2. Back up your Gogs instance, including the database and repository data. 3. Follow the official Gogs upgrade documentation for your deployment method (binary, Docker, package manager, etc.). 4. Apply the upgrade to version 0.14.3 or later. 5. Test redirect functionality in your upgraded instance to ensure no regressions. 6. Monitor logs for any unusual redirect patterns post-upgrade. Verify against the vendor's release notes that the IsSameSite validation function has been patched.

Detection guidance

Monitor Gogs access logs for suspicious redirect_to parameters containing patterns like '../', '..\', or other directory traversal sequences. Look for log entries where the redirect destination differs significantly from the request origin. Additionally, track user reports of unexpected redirects or phishing-like behavior originating from Gogs links. If you operate a SIEM, create alerts for redirect_to parameters that fail to match your organization's expected redirect domains. Consider logging all redirect events at DEBUG level during the remediation window.

Why prioritize this

Although the CVSS score is medium (5.4), this vulnerability should be prioritized based on attack likelihood and user trust. Gogs instances hosting open-source or internal development projects are trusted channels; attackers can exploit that trust to launch convincing phishing campaigns. The ease of crafting a malicious redirect and the broad attack surface (many redirect endpoints) elevate practical risk. Patch this within your standard update cycle, and do not deprioritize based on the CVSS score alone.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, but it requires user interaction (clicking a link) and causes limited direct impact—the attacker gains only information disclosure or integrity issues on the user's endpoint (session hijacking, malware infection), not on the server itself. There is no availability impact. The score is accurate but somewhat conservative; the real-world risk is elevated by the reputational impact and the likelihood of social engineering within trusted development communities.

Frequently asked questions