CVE-2026-47267

Gogs: SSRF in webhook deliveries

State: Published
Severity: 8.3 High
Published: Jun 24, 2026
Updated: Jun 25, 2026
Reserved: May 18, 2026

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
gogsgogs	< 0.14.3Affected

References

https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g
https://github.com/gogs/gogs/pull/8263
https://github.com/gogs/gogs/commit/199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.