CVE-2025-8110
Gogs Path Traversal Vulnerability
Description
CVE-2025-8110 is a high-severity path traversal vulnerability (CVSS 8.8) in Gogs, the popular self-hosted Git service. The flaw exploits improper symbolic link handling in the PutContents API, allowing an authenticated user to achieve local code execution on the Gogs server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 2, 2026. With an EPSS score of 0.26548 (96.2nd percentile), it ranks among the most likely vulnerabilities to be exploited. All versions of Gogs up to and including 0.13.3 are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gogs | gogs | <= 0.13.3 |
References
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit(Exploit, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2025/12/11/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/12/11/4(Mailing List)
- http://www.openwall.com/lists/oss-security/2026/01/17/4(Mailing List)
- http://www.openwall.com/lists/oss-security/2026/01/18/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2026/01/18/2(Mailing List)
- https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6(Patch)
- https://github.com/gogs/gogs/pull/8078(Exploit, Issue Tracking, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110(Third Party Advisory, US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes vulnerabilities where software uses external input to construct a pathname for a file or directory, but fails to properly neutralize special elements such as ".." or symbolic links that could cause the path to resolve outside the intended restricted directory. In CVE-2025-8110, the Gogs PutContents API does not properly validate symbolic links within repository contents, allowing an attacker to write files to arbitrary locations on the server's filesystem. This can lead to remote code execution when critical system or application files are overwritten.
Impact Analysis
The business impact of CVE-2025-8110 is severe for organizations running self-hosted Gogs instances. Confidentiality is fully compromised because the attacker can read arbitrary files from the server filesystem by following symbolic links, potentially accessing configuration files, database credentials, SSH keys, and source code from other repositories. Integrity is fully compromised as the attacker can write arbitrary files, enabling modification of application code, injection of backdoors, or alteration of Git repository data. Availability is also fully impacted since the attacker could delete critical files or disrupt the Gogs service entirely. The EPSS score of 0.26548 places this vulnerability in the 96.2nd percentile, indicating extremely high exploitation probability. Multiple public exploits and detailed technical write-ups exist, including research published by Wiz and a corresponding GitHub pull request with exploit details. Because Gogs instances often store sensitive source code and may have access to internal networks, successful exploitation can lead to intellectual property theft, supply chain compromise, and lateral movement into other infrastructure. Ransomware association is listed as unknown, but the combination of remote code execution and access to valuable code repositories makes this an attractive target for extortion-oriented threat actors.
Exploit Maturity
CVE-2025-8110 has a mature exploit landscape. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of February 2, 2026, confirming active exploitation in the wild. The EPSS score of 0.26548 (96.2nd percentile) reflects the high likelihood of exploitation. Public exploit information is available from multiple sources: Wiz Research published a detailed exploit write-up demonstrating the full attack chain from authenticated access to remote code execution, and the Gogs GitHub pull request #8078 contains both the patch and exploit-relevant technical details. Multiple discussions on the oss-security mailing list further disseminate knowledge of the vulnerability. The ransomware association is currently unknown, but given the availability of working exploits and the high value of Git hosting targets, the risk of ransomware operators incorporating this exploit is considerable.
Remediation
- Upgrade Gogs or apply the security patch — The fix is available in commit 553707f. Upgrade to a version newer than 0.13.3 that includes this patch. If upgrading is not immediately possible, cherry-pick the fix into your current deployment.
- Restrict user registration and access — Since the vulnerability requires authenticated access, limit who can create accounts on your Gogs instance. Disable public registration if not needed and audit existing user accounts for unauthorized entries.
- Audit repositories for suspicious symbolic links — Examine existing repositories for symbolic links that point outside the repository directory, which could indicate exploitation attempts or pre-positioned attack vectors.
- Consider migrating to an actively maintained alternative — Gogs has a slower security response cadence compared to alternatives like Gitea (a Gogs fork) or GitLab. Evaluate whether migrating to a platform with more active security support is appropriate for your organization.
- Monitor server filesystem for unauthorized changes — Implement file integrity monitoring on the Gogs server to detect unexpected file modifications, especially in application directories, SSH authorized_keys files, and cron configurations.
Technical Details
The CVSS v3.1 vector for CVE-2025-8110 is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.8 (High). Attack Vector (Network) means the vulnerability is exploitable remotely from anywhere that can reach the Gogs web interface. Attack Complexity (Low) indicates the exploit is straightforward and reliable. Privileges Required (Low) means the attacker needs only a standard Gogs user account, not an administrator role. User Interaction (None) confirms no action from another user is needed. Scope (Unchanged) means the impact is within the Gogs application's security boundary, though in practice the attacker gains OS-level access. Confidentiality, Integrity, and Availability are all High, reflecting the attacker's ability to read, write, and delete arbitrary files on the server. The attack mechanism targets the PutContents API endpoint, which is used to create or update files within a Git repository through the web interface. By creating a symbolic link within a repository that points to a location outside the repository's storage directory, and then using the PutContents API to write content through that symbolic link, the attacker can write arbitrary data to any file accessible by the Gogs process. This can be leveraged for code execution by overwriting Gogs templates, Git hooks, or system files such as cron jobs or SSH authorized keys.
Frequently Asked Questions
What is Gogs and who is affected?
Gogs is a lightweight, self-hosted Git service written in Go, commonly used by development teams who prefer to host their own Git repositories rather than using cloud services. All versions up to and including 0.13.3 are affected, meaning any organization running an unpatched Gogs instance is vulnerable.
Does the attacker need to be an administrator to exploit this?
No, only a standard authenticated Gogs user account is required. The attacker does not need administrator privileges, which means that any user with repository write access can potentially exploit this vulnerability.
Are there public exploits available for CVE-2025-8110?
Yes, detailed exploit information has been published by Wiz Research and is available in the Gogs GitHub repository pull request. These resources provide enough technical detail for attackers to reproduce the exploit, making prompt patching critical.
Should I migrate away from Gogs?
While migrating is not strictly required if you apply the patch, organizations should evaluate whether Gogs's maintenance cadence meets their security requirements. Gitea, a well-maintained fork of Gogs, and GitLab are alternatives that may offer faster security response times.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.