High severity8.3NVD Advisory· Published Jun 24, 2026· Updated Jun 25, 2026

CVE-2026-47267

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
gogs.io/gogsGo	< 0.14.3	0.14.3

Affected products

Gogs/Gogsllm-fuzzy
Range: <0.14.3
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-c4v7-xg93-qf8gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-47267ghsaADVISORY
github.com/gogs/gogs/commit/199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018nvdWEB
github.com/gogs/gogs/pull/8263nvdWEB
github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8gnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.540
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000