Actively exploited · Published Dec 10, 2025 · Assigned by Wiz
CVE-2025-8110File overwrite in file update API in Gogs
High 8.7 Exploited
In plain English
A high-severity path traversal in Gogs from Gogs. Attackers are actively exploiting it in the wild (listed by CISA on January 12, 2026). The chance it is exploited in the next 30 days is estimated at 85.2% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 2, 2026.
Official description
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | no fix listed | GHSA-mq8m-42gh-wq7r |
| Go | gogs.io/gogs | no fix listed | GO-2025-4225 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C
References
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- https://github.com/gogs/gogs/pull/8078 issue-tracking
- https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110 government-resource
- http://www.openwall.com/lists/oss-security/2025/12/11/3
- http://www.openwall.com/lists/oss-security/2025/12/11/4
- http://www.openwall.com/lists/oss-security/2026/01/17/4
- http://www.openwall.com/lists/oss-security/2026/01/18/1
- http://www.openwall.com/lists/oss-security/2026/01/18/2