https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:05:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330206 EUVD-2026-330206 https://cve.radiocsirt.org/vuln/euvd-2026-330206 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52801 <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.</p> <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52801 https://cve.radiocsirt.org/vuln/ghsa-wv27-2vqp-j7g5 <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Summary The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.</p> <p>### Details Here is the function implementation of the secure New Migration functionality. &lt;img width=&#34;1200&#34; height=&#34;755&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96&#34; /&gt;</p> <p>Here is the function implementation of the Mirror Settings without any validation. &lt;img width=&#34;1200&#34; height=&#34;477&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7&#34; /&gt;</p> <p>### PoC The New Migration feature correctly blocked my attempt to import a local repository. &lt;img width=&#34;1200&#34; height=&#34;1008&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e&#34; /&gt;</p> <p>But if I create a normal migration with a valid repository. &lt;img width=&#34;1200&#34; height=&#34;1006&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac&#34; /&gt;</p> <p>Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository. &lt;img width=&#34;1200&#34; height=&#34;476&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7&#34; /&gt;</p> <p>Here is the result after the sync. &lt;img width=&#34;1200&#34; height=&#34;533&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1df76642-3e55-4493-a4…</p> <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Summary The Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.</p> <p>### Details Here is the function implementation of the secure New Migration functionality. &lt;img width=&#34;1200&#34; height=&#34;755&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96&#34; /&gt;</p> <p>Here is the function implementation of the Mirror Settings without any validation. &lt;img width=&#34;1200&#34; height=&#34;477&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7&#34; /&gt;</p> <p>### PoC The New Migration feature correctly blocked my attempt to import a local repository. &lt;img width=&#34;1200&#34; height=&#34;1008&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e&#34; /&gt;</p> <p>But if I create a normal migration with a valid repository. &lt;img width=&#34;1200&#34; height=&#34;1006&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac&#34; /&gt;</p> <p>Then, I could use the Mirror Settings feature under the Repository Settings sync a local repository. &lt;img width=&#34;1200&#34; height=&#34;476&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7&#34; /&gt;</p> <p>Here is the result after the sync. &lt;img width=&#34;1200&#34; height=&#34;533&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1df76642-3e55-4493-a4…</p> https://cve.radiocsirt.org/vuln/ghsa-wv27-2vqp-j7g5 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2013 <p>Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2013