CVE-2025-8110highunder attackCWE-22

CVE-2025-8110: high-severity vulnerability in Gogs

File overwrite in file update API in Gogs

Published · Updated

Follow this CVE+ Monitor gogs+ Monitor gogs.io/gogs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.7epss 85%
from disclosure to weapon1 day
Published on NVDDec 10
1st PoC+1d
CISA KEV+33d
Action required by CISAfederal deadline: 2026-02-02

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Gogs' file update API fails to properly handle symbolic links, allowing an attacker to overwrite arbitrary files on the system. This can lead to executing malicious code by replacing critical files.

Technical detail

CWE-22 path traversal vulnerability in the PutContents API permits improper symbolic link resolution, enabling local file overwrite. An authenticated or local attacker can exploit this to replace sensitive files and achieve arbitrary code execution without proper path validation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C
Affected products
Gogs · Gogs
public PoCs found — 40
githubgithub.com/zAbuQasem/gogs-CVE-2025-8110★ 27githubgithub.com/rxerium/CVE-2025-8110★ 22githubgithub.com/kayl22/cve-2025-8110-GOGS-RCE★ 4githubgithub.com/Ghxstsec/CVE-2025-8110★ 2githubgithub.com/3jee/CVE-2025-8110★ 2githubgithub.com/0dgt/CVE-2025-8110★ 1githubgithub.com/George0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-Execution★ 1githubgithub.com/X4BROZER/CVE-2025-8110★ 0githubgithub.com/popyue/CVE-2025-8110★ 0githubgithub.com/hassan-hamadi/CVE-2025-8110-Silentium-HTB★ 0githubgithub.com/AdityaInnovates/CVE-2025-8110-Gogs-RCE-Exploit★ 0githubgithub.com/get-xor/coreweave-demo-2026-05★ 0githubgithub.com/mananispiwpiw/CVE-2025-8110-PoC★ 0githubgithub.com/111ddea/goga-cve-2025-8110★ 0githubgithub.com/tovd-go/CVE-2025-8110★ 0vulncheckvulncheck.com/xdb/de4a1007db99unverifiedvulncheckvulncheck.com/xdb/05917d8228dbunverifiedvulncheckvulncheck.com/xdb/ac0be103d4c4unverifiedvulncheckvulncheck.com/xdb/942ecab2b7f3unverifiedvulncheckvulncheck.com/xdb/09d4e433b3f5unverifiedvulncheckvulncheck.com/xdb/171bf6de0983unverifiedvulncheckvulncheck.com/xdb/44dce5b3aeaeunverifiedvulncheckvulncheck.com/xdb/4cdb8568f534unverifiedvulncheckvulncheck.com/xdb/296e89f144f1unverifiedvulncheckvulncheck.com/xdb/05267f6f9622unverifiedvulncheckvulncheck.com/xdb/b395eb11b98cunverifiedvulncheckvulncheck.com/xdb/4248b0b62084unverifiedvulncheckvulncheck.com/xdb/8c052f039321unverifiedvulncheckvulncheck.com/xdb/f576646c689funverifiedvulncheckvulncheck.com/xdb/d68ff06fafb4unverifiedvulncheckvulncheck.com/xdb/ead9b44096c4unverifiedvulncheckvulncheck.com/xdb/b5ef86fdc299unverifiedvulncheckvulncheck.com/xdb/71e20d83ec6eunverifiedvulncheckvulncheck.com/xdb/eb4ab0711710unverifiedvulncheckvulncheck.com/xdb/d77d0ae38d33unverifiedvulncheckvulncheck.com/xdb/b54a4a7d5b85unverifiedvulncheckvulncheck.com/xdb/3bd09f5454e2unverifiedvulncheckvulncheck.com/xdb/4c10f660ef24unverifiedvulncheckvulncheck.com/xdb/f4c9b7664327unverifiedvulncheckvulncheck.com/xdb/1f47c9cb7409unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Gogs

In the same product, most dangerous first.

CVE-2026-123012HIGHCVE-2026-123012EPSS 0.3%