CVE-2026-47267— Gogs webhook交付功能服务器端请求伪造漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-47267の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Gogs: SSRF in webhook deliveries
ソース: NVD (National Vulnerability Database)
脆弱性説明
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
服务端请求伪造(SSRF)
ソース: NVD (National Vulnerability Database)
影響を受ける製品
II. CVE-2026-47267の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-47267のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-47267 其他参考 (3)
Same Patch Batch · gogs · 2026-06-24 · 24 CVEs total
| CVE-2026-52813 | 10.0 CRITICAL | Gogs: Path Traversal in organization name results in RCE through Git hooks |
| CVE-2026-52806 | 9.9 CRITICAL | Gogs: RCE via git rebase --exec argument injection in pull request merge |
| CVE-2026-52798 | 8.9 HIGH | Gogs: Stored XSS in `.ipynb` Preview |
| CVE-2026-52800 | 8.8 HIGH | Gogs: CSRF Leading to Organization Owner Takeover |
| CVE-2026-52805 | 8.7 HIGH | Gogs: Migration Redirect Bypass Leads to Internal Repository Theft |
| CVE-2026-52797 | 8.5 HIGH | Gogs: Overwriting critical files results in a denial of service |
| CVE-2026-52801 | 8.1 HIGH | Gogs: Ability to import local repositories via Mirror Settings |
| CVE-2026-52799 | 7.5 HIGH | Gogs: Missing Authorization in Attachment Download |
| CVE-2026-52808 | 7.1 HIGH | Gogs: Write-level collaborators can mutate admin-only repository settings via API |
| CVE-2026-52809 | 6.8 MEDIUM | Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_ |
| CVE-2026-52802 | 5.4 MEDIUM | Gogs: Open Redirect via redirect_to in Gogs |
| CVE-2025-64719 | 4.9 MEDIUM | Gogs: Denial of Service in repository/wiki file listing web pages |
| CVE-2026-52795 | 4.3 MEDIUM | Gogs: Authorization Bypass in Watch API allows any user to monitor private repository acti |
| CVE-2026-52796 | 3.5 LOW | Gogs: DoS in rendering issue index pattern |
| CVE-2026-52814 | Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Des | |
| CVE-2026-52810 | Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusio | |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenants | |
| CVE-2026-52807 | Gogs: DOM-based XSS via Milestone Name on New Issue Page | |
| CVE-2026-52804 | Gogs: Privilege Escalation via Collaboration Access Mode Validation | |
| CVE-2026-52815 | Gogs: Unauthenticated Organization Teams Information Disclosure via API |
Showing 20 of 24 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: gogs
- CVE-2026-52797
Gogs: Overwriting critical files results in a denial of serv - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE thr - CVE-2026-52812
Gogs: LFS dedupe path leaks private repo content across tena - CVE-2026-52811
Gogs: UploadRepoFiles writes outside repo working tree via c - CVE-2026-52810
Gogs: Write to readonly repositories using receive-pack + se
同じベンダー: gogs
- CVE-2026-52797
Gogs: Overwriting critical files results in a denial of serv - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE thr - CVE-2026-52812
Gogs: LFS dedupe path leaks private repo content across tena - CVE-2026-52811
Gogs: UploadRepoFiles writes outside repo working tree via c - CVE-2026-52810
Gogs: Write to readonly repositories using receive-pack + se
同じ弱点: CWE-918
- CVE-2026-28385
SSRF via image import from URL allows internal network probi - CVE-2026-56663
AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP v - CVE-2026-57627
WordPress Kirki plugin <= 6.0.11 - Server Side Request Forge - CVE-2026-56026
WordPress utm.codes plugin <= 1.9.0 - Server Side Request Fo - CVE-2026-4339
SSRF via unvalidated attachment URLs in Mattermost Agents pl
V. CVE-2026-47267へのコメント
まだコメントはありません