Gogs - RCE (CVE-2025-8110)
Description
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
psychologyCrowdSec Analysis
CVE-2025-8110 is a remote code execution flaw in Gogs, the self-hosted Git service: the PutContents API does not validate paths that go through symbolic links, which bypasses the fix for CVE-2024-55947 and lets an authenticated user write files outside the repository, including Git hooks that execute on the server. It was exploited as a zero-day and is listed in CISA's KEV catalogue.
CrowdSec has been tracking this vulnerability and its exploits since 30th of January 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-8110 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers with an account create a symbolic link in a repository, then call the PutContents API through it to overwrite files such as Git hooks and gain code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-12-10 |
| CISA KEV | 2026-01-12 |
| Rule Released | 2026-01-30 |
| CISA Remediation Deadline | 2026-02-02 |
| CrowdSec First Seen | 2026-02-06 |
Related Weaknesses
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Remediation & Protection
External References
- http://www.openwall.com/lists/oss-security/2026/01/17/4
- http://www.openwall.com/lists/oss-security/2026/01/18/2
- https://github.com/gogs/gogs/pull/8078
- http://www.openwall.com/lists/oss-security/2025/12/11/4
- http://www.openwall.com/lists/oss-security/2025/12/11/3
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110
- https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- http://www.openwall.com/lists/oss-security/2026/01/18/1