CVE-2025-8110

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.852 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 23 exploits · PoC

Likely / severe?

85.2% (100th) EPSS

CVSS 8.8 · high

Is it mine?

7 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

added 2026-01-12remediate by 2026-02-02

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-23

Gogs Path Traversal Vulnerability

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:Csecondary · ENISA EU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Xsecondary

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22USCWE-22US

exploits (23)

Public proof-of-concept and weaponised exploit code.

0dgt/CVE-2025-8110RCE exploit for Gogs <= 0.13.3PoC · poc_in_github
111ddea/goga-cve-2025-8110验证 Gogs 版本 0.13.2 是否存在 **CVE-2025-8110 (符号链接文件覆盖)** 漏洞。PoC · poc_in_github
3jee/CVE-2025-8110CVE-2025-8110 — Gogs <= 0.13.3 Arbitrary File Write via Symlink Traversal in PutContents APIPoC · poc_in_github
9xh4kv/CVE-2025-8110PoC for CVE-2025-8110: Authenticated RCE in Gogs via symlink bypass in PutContents APIPoC · poc_in_github
AdityaInnovates/CVE-2025-8110-Gogs-RCE-ExploitGogs CVE-2025-8110 RCE ExploitPoC · poc_in_github
George0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-ExecutionGeorge0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-ExecutionPoC · poc_in_github

affected products (7)

Products and version ranges known to be affected.

Open Source Gogs <=0.13.3all versionscert_bundDE
Open Source Gogs≤ 0.13.3cert_bundDE
gogs gogs≤ 0 ≤0.13.3enisa_euvdEU
Сообщество свободного программного обеспечения Gogs≤ 0.13.3fstec_bduRU
gogs gogs≤ 0.13.3nvdUScpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*
Go gogs.io/gogs≤ 0.13.3osvUSpkg:golang/gogs.io/gogs
Go gogs.io/gogsall versionsosvUSpkg:golang/gogs.io/gogs

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2821Gogs: Schwachstelle ermöglicht CodeausführungDeutsch2025-12-10csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gogs ausnutzen, um beliebigen Programmcode auszuführen.
GHSA-mq8m-42gh-wq7rGogs vulnerable to a bypass of CVE-2024-559472025-12-10ghsa · osvUS
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
GO-2025-4225Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs2025-12-15vendor · osvUS
Gogs vulnerable to a bypass of CVE-2024-55947 in gogs.io/gogs

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2025-12-10modified 2026-06-17

references (11)

External citations — patches, advisories, analysis.

http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit cnnvd
http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit enisa_euvd
http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploitExploitThird Party Advisorynvd
http://www.openwall.com/lists/oss-security/2025/12/11/3Mailing Listnvd
http://www.openwall.com/lists/oss-security/2025/12/11/4Mailing Listnvd
http://www.openwall.com/lists/oss-security/2026/01/17/4Mailing Listnvd
http://www.openwall.com/lists/oss-security/2026/01/18/1Mailing Listnvd
http://www.openwall.com/lists/oss-security/2026/01/18/2Mailing Listnvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan