CVE-2025-8110

8.8

HIGH CVSS 3.1

Gogs Path Traversal Vulnerability - [Actively Exploited]

Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

INFO

Published Date :

Dec. 10, 2025, 2:16 p.m.

Last Modified :

Jan. 20, 2026, 1:47 p.m.

Remotely Exploit :

Yes !

Source :

9947ef80-c5d5-474a-bbab-97341a59000e

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 02, 2026 | 7 days left

Alert Date: Jan 12, 2026 | 13 days ago

Description :

Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8110

Affected Products

The following products are affected by CVE-2025-8110 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Gogs	gogs

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	HIGH	[email protected]
CVSS 4.0	HIGH	9947ef80-c5d5-474a-bbab-97341a59000e
CVSS 4.0	HIGH	9947ef80-c5d5-474a-bbab-97341a59000e

Solution

Address improper symbolic link handling in the PutContents API to prevent local code execution.

Update Gogs to the latest version.
Review and sanitize all symbolic link operations.
Implement strict input validation for API calls.

Public PoC/Exploit Available at Github

CVE-2025-8110 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-8110.

URL	Resource
http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit	Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/12/11/3	Mailing List
http://www.openwall.com/lists/oss-security/2025/12/11/4	Mailing List
http://www.openwall.com/lists/oss-security/2026/01/17/4	Mailing List
http://www.openwall.com/lists/oss-security/2026/01/18/1	Mailing List
http://www.openwall.com/lists/oss-security/2026/01/18/2	Mailing List
https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6	Patch
https://github.com/gogs/gogs/pull/8078	Exploit Issue Tracking Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110	Third Party Advisory US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-8110 is associated with the following CWEs:

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-8110 weaknesses.

CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-126: Path Traversal Path Traversal

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

freiwi/CVE-2025-8110

🔍 Detect improper symbolic link handling in Gogs' PutContents API, exposing local code execution risks for versions 0.13.3 and earlier.

action-recognition agent chinese cv gluon image-classification jupyter-notebook llm machine-learning mxnet nlp notebook object-detection pose-estimation python semantic-segmentation

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Dec. 31, 2025, 1:25 p.m. This repo has been linked 1 different CVEs too.

tovd-go/CVE-2025-8110

None

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Dec. 24, 2025, 2:35 a.m. This repo has been linked 1 different CVEs too.

111ddea/goga-cve-2025-8110

验证 Gogs 版本 0.13.2 是否存在 **CVE-2025-8110 (符号链接文件覆盖)** 漏洞。

Python Shell

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Dec. 24, 2025, 1:40 a.m. This repo has been linked 1 different CVEs too.

zAbuQasem/gogs-CVE-2025-8110

CVE-2025-8110 PoC

Python

Updated: 1 month ago

4 stars 0 fork 0 watcher

Born at : Dec. 13, 2025, 4:15 a.m. This repo has been linked 1 different CVEs too.

Ashwesker/Blackash-CVE-2025-8110

CVE-2025-8110

Python

Updated: 1 month, 1 week ago

2 stars 0 fork 0 watcher

Born at : Dec. 11, 2025, 7:10 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-8110

Detection template for CVE-2025-8110

Updated: 1 month, 1 week ago

21 stars 0 fork 0 watcher

Born at : Dec. 11, 2025, 10:37 a.m. This repo has been linked 1 different CVEs too.

Threekiii/CVE

一个 CVE 漏洞预警知识库，无 exp/poc，部分包含修复方案。A knowledge base of CVE security vulnerability, no PoCs/exploits.

Updated: 2 weeks, 5 days ago

155 stars 23 fork 23 watcher

Born at : Jan. 5, 2023, 2:19 a.m. This repo has been linked 213 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 39 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks, 1 day ago

7462 stars 1233 fork 1233 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 826 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-8110 vulnerability anywhere in the article.

TheCyberThrone

Microsoft Patch Tuesday – January 2026

January 14, 2026Microsoft’s January 13, 2026, Patch Tuesday release addresses 114 vulnerabilities, including one actively exploited zero-day in Desktop Window Manager, eight critical flaws, and three ...

Published Date: Jan 14, 2026 (1 week, 4 days ago)

security.nl

VS meldt actief misbruik van path traversal-lek in Git-service Gogs

Aanvallers maken actief misbruik van een path traversal-lek in Git-service Gogs, zo laat het Amerikaanse cyberagentschap CISA weten. Volgens securitybedrijf Wiz wordt het beveiligingslek al zeker sind ...

Published Date: Jan 13, 2026 (1 week, 4 days ago)

CybersecurityNews

CISA Warns of Gogs Path Traversal Vulnerability Exploited in Attacks

A critical warning about a path traversal vulnerability in Gogs, a self-hosted Git service, that is being actively exploited in the wild. The vulnerability, tracked as CVE-2025-8110, was added to CISA ...

Published Date: Jan 13, 2026 (1 week, 4 days ago)

The Hacker News

CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution

Jan 13, 2026Ravie LakshmananVulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw impac ...

Published Date: Jan 13, 2026 (1 week, 4 days ago)

Daily CyberSecurity

AI Identity Theft: Critical ServiceNow Flaw (CVE-2025-12420) Allows Unauthenticated Impersonation

A critical vulnerability has been uncovered in the ServiceNow AI Platform, potentially allowing unauthenticated attackers to masquerade as legitimate users. With a severity score of 9.3 out of 10, the ...

Published Date: Jan 13, 2026 (1 week, 5 days ago)

Daily CyberSecurity

CISA “Must-Patch” Alert: Critical Gogs Exploit CVE-2025-8110 Active in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has added a dangerous new entry to its “Must-Patch” list, warning that a popular tool used by developers worldwide is actively being exploit ...

Published Date: Jan 13, 2026 (1 week, 5 days ago)

TheCyberThrone

CISA Adds Gogs RCE Vulnerability CVE-2025-8110 to KEV

January 13, 2026The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-8110, a high-severity remote code execution flaw in Gogs (Go Git Service), to its Known Exploited Vu ...

Published Date: Jan 13, 2026 (1 week, 5 days ago)

BleepingComputer

CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to secure their systems against a high-severity Gogs vulnerability that was exploited in zero-day atta ...

Published Date: Jan 12, 2026 (1 week, 5 days ago)

Daily CyberSecurity

The Developer Win: GitHub Postpones Self-Hosted Runner Fee After Massive Community Outcry

Recently, the code hosting platform GitHub published a blog post announcing that, starting March 1, 2026, GitHub Actions would begin charging an additional platform fee. Under the proposed change, dev ...