CVE-2026-47267CWE-918

Gogs: SSRF in webhook deliveries

High · published June 24, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-24T20:09Z
EPSS history
Timeline
  • 24 JUN 20:09Z
    Gogs: SSRF in webhook deliveries
    cvelistv5