CVE-2022-0870: SSRF in repository migration in gogs.io/gogs
Summary
CVE-2022-0870: SSRF in repository migration. Affects gogs.io/gogs versions < 0.12.5. Fixed in 0.12.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is a self-hosted Git service written in Go. It provides a platform for hosting Git repositories and offers features such as issue tracking, pull requests, and user management. The repository migration functionality allows users to import repositories from other sources. However, a vulnerability in this functionality allows a malicious user to perform Server-Side Request Forgery (SSRF) attacks and discover services in the internal network. This vulnerability affects all installations of Gogs that accept public traffic. It is important to note that using internal network CIDRs as repository migration targets is prohibited. Users are advised to upgrade to version 0.12.5 or the latest 0.13.0+dev. Until the upgrade is performed, it is recommended to run Gogs in its own private network.
Vulnerability Detail
The SSRF vulnerability in Gogs' repository migration functionality enables an attacker to send crafted requests that can access internal network services. By exploiting this vulnerability, a malicious user can discover and potentially exploit sensitive services within the internal network. This can lead to unauthorized access, data leakage, or further compromise of the system. The vulnerability has a CVSS score of 5.0, indicating a moderate severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.5
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to run Gogs in a private network that is isolated from the public internet. By restricting access to Gogs from external sources, the risk of SSRF attacks can be minimized. However, this is not a permanent solution, and upgrading to the latest version is strongly recommended.
Conclusion
The SSRF vulnerability in Gogs' repository migration functionality poses a moderate risk to installations that accept public traffic. It is crucial for users to upgrade to version 0.12.5 or the latest 0.13.0+dev to address this vulnerability. In the meantime, running Gogs in a private network can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
Gogs is a self-hosted Git service that allows users to host their own Git repositories and manage them using a web interface. It is written in Go and provides features similar to popular Git hosting platforms.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal network resources from a vulnerable server. In this case, the SSRF vulnerability in Gogs' repository migration functionality enables an attacker to discover services within the internal network.
By leveraging the SSRF vulnerability in Gogs, an attacker can send crafted requests that target internal network services. This can lead to unauthorized access, data leakage, or further compromise of the system.
The impact of this vulnerability can vary depending on the specific services accessible within the internal network. However, it can potentially lead to unauthorized access, data exposure, or even complete compromise of the affected system.
Yes, all installations of Gogs that accept public traffic are affected by this vulnerability. It is important to upgrade to the latest version or apply the recommended workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
