Gogs · Gogs

CVE-2025-8110

File overwrite in file update API in Gogs

Exploited in attacks High 8.7 Attack chance: 85%

What it is

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CISA: Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 2, 2026

Added to the CISA list: January 12, 2026
Published: December 10, 2025
Severity: High 8.7 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 85% in the top 0.3% of all known vulnerabilities
Weakness: CWE-22
More details: NVD · CVE.org · CISA

All references (1)

http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.