CVE-2026-47267

8.3 Élevée

Publiée le 24/06/2026 à 23:16 · Modifiée le 25/06/2026 à 16:19 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

Traduire en français

Produits concernés

gogs

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.3 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-918

Références

https://github.com/gogs/gogs/commit/199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018
https://github.com/gogs/gogs/pull/8263
https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g
https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories