Open Redirect Vulnerability in Gogs Git Service

CVE-2026-52802

What is CVE-2026-52802?

Gogs, an open source self-hosted Git service, contains an open redirect vulnerability in versions prior to 0.14.3. This vulnerability occurs when the 'redirect_to' parameters provided by an attacker are not properly validated, allowing redirection to arbitrary external sites. The flawed validation checks within Gogs, specifically in the IsSameSite function, only consider the first two characters of the URL, which enables exploitation through directory traversal sequences followed by backslashes. Users are advised to update to version 0.14.3 or later to secure their installations against this vulnerability.

References