GHSA-XXHQ-69MF-W8CR

Vulnerability from github – Published: 2026-06-23 16:42 – Updated: 2026-07-21 13:36
VLAI
Summary
Gogs has an Open Redirect via redirect_to
Details

Summary

An open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites.

Details

All redirects in Gogs that are validated via the IsSameSite function are vulnerable:

func IsSameSite(url string) bool {
    return len(url) >= 2 && url[0] == '/' && url[1] != '/' && url[1] != '\\'
}

The function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. For example:

/a/../\example.com

The IsSameSite function checks the input supplied to the redirect_to query parameter value /a/../\example.com and considers it valid.

Because web browsers normalize backslashes \ to forward slashes /, the normalized URL becomes //example.com.

The normalized URL becomes:

//example.com

Resulting in a cross-origin redirect.

This affects all endpoints using the redirect_to query parameter, including login and other post-action flows.

PoC

  1. An attacker can provide a user with a link to login to Gogs with a redirect_to query parameter that redirects a user to a site the attacker wants them to visit:
http://192.168.236.132:3000/user/login?redirect_to=/a/../\example.com

image



  1. After the user successfully logs in, they would be redirected to the site an attacker wants them to visit:

image

image

Impact

  • Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
  • OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
  • Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
  • Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.14.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52802"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T16:42:02Z",
    "nvd_published_at": "2026-06-24T21:16:56Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn open redirect vulnerability exists in Gogs where attacker-controlled `redirect_to` parameters can bypass validation, allowing redirection to arbitrary external sites.\n\n\n### Details\nAll redirects in Gogs that are validated via the `IsSameSite` function are vulnerable:\n```go\nfunc IsSameSite(url string) bool {\n    return len(url) \u003e= 2 \u0026\u0026 url[0] == \u0027/\u0027 \u0026\u0026 url[1] != \u0027/\u0027 \u0026\u0026 url[1] != \u0027\\\\\u0027\n}\n```\n\nThe function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. For example:\n```\n/a/../\\example.com\n```\n\nThe `IsSameSite` function checks the input supplied to the `redirect_to` query parameter value `/a/../\\example.com` and considers it valid.\n\nBecause web browsers normalize backslashes `\\` to forward slashes `/`, the normalized URL becomes `//example.com`.\n\nThe normalized URL becomes:\n```\n//example.com\n```\n\nResulting in a cross-origin redirect.\n\nThis affects all endpoints using the `redirect_to` query parameter, including login and other post-action flows.\n\n\n### PoC\n\n1. An attacker can provide a user with a link to login to Gogs with a `redirect_to` query parameter that redirects a user to a site the attacker wants them to visit:\n```\nhttp://192.168.236.132:3000/user/login?redirect_to=/a/../\\example.com\n```\n\n\u003cimg width=\"1339\" height=\"536\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3c2a13b8-f0b7-42c2-a223-6f0ebf083589\" /\u003e  \n\n\u003cbr\u003e\n\u003cbr\u003e\n\n2. After the user successfully logs in, they would be redirected to the site an attacker wants them to visit:\n\n\u003cimg width=\"1066\" height=\"463\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1726a3d9-6705-43cc-bdd2-90aad105d021\" /\u003e\n\n\u003cimg width=\"1097\" height=\"396\" alt=\"image\" src=\"https://github.com/user-attachments/assets/376052f5-0e00-4d14-a548-fa75a6269530\" /\u003e\n\n\n### Impact\n* Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n* OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect\n* Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n* Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users",
  "id": "GHSA-xxhq-69mf-w8cr",
  "modified": "2026-07-21T13:36:21Z",
  "published": "2026-06-23T16:42:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52802"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/8322"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/releases/tag/v0.14.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gogs has an Open Redirect via redirect_to"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.