actively-exploited-vulnerabilityinternet-facing-service-vulnerabilityinternet-exposed-servicedetection-content-update

Remote Code Execution via File Overwrite in Gogs PutContents API

Active Exploitation · 19 sources · Updated 4mo ago · First seen Dec 10, 2025

A critical vulnerability, tracked as CVE-2025-8110, has been identified in the PutContents API of the Gogs self-hosted Git service. The flaw arises from improper handling of symbolic links, allowing remote, authenticated attackers to overwrite arbitrary files on the server. Successful exploitation enables attackers to execute arbitrary code with the privileges of the Gogs server process, potentially leading to full system compromise. Security researchers have reported that this vulnerability is being actively exploited in the wild, and it affects Gogs versions 0.13.3 and prior.

Currently, there is no patched version available to address CVE-2025-8110. Administrators are advised to disable auto-registration of users and avoid exposing Gogs instances to the internet as temporary mitigations. Detection of vulnerable systems can be performed using specific queries to identify Gogs installations, such as searching for HTTP services with a known favicon hash. Organizations running Gogs should prioritize mitigation steps to reduce the risk of exploitation until an official fix is released.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jul 1, 2025 – Dec 11, 2025

Dec 11, 202511mo ago
Forgejo and Gitea are reported likely unaffected
In an oss-security follow-up on December 11, 2025, a Forgejo developer said the relevant code in Gitea, and therefore Forgejo, had previously been rewritten and attack attempts had not succeeded. This indicated the notable Gogs forks were most likely not affected by CVE-2025-8110.
Dec 10, 202511mo ago
Reports detail Supershell malware use and scale of compromise
Public reporting on December 10-11, 2025 tied the exploitation to Supershell C2 malware and estimated that over 700 of roughly 1,400-1,500 internet-facing Gogs instances showed signs of compromise. Researchers said the attacks appeared opportunistic, widespread, and likely run by a single actor or group.
Dec 10, 202511mo ago
CVE-2025-8110 is published in vulnerability databases
On December 10, 2025, CVE-2025-8110 was formally published with high-severity scoring and descriptions of the PutContents API symlink handling flaw in Gogs. Public proof-of-concept and technical details were also referenced by vulnerability feeds.
Dec 10, 202511mo ago
Wiz publicly discloses active exploitation of CVE-2025-8110
Wiz published research on December 10, 2025 describing CVE-2025-8110 as an actively exploited Gogs zero-day affecting version 0.13.3 and earlier. The disclosure said more than 700 public-facing instances had been compromised, no patch was yet available, and published indicators of compromise and mitigations were provided.
Nov 1, 20251y ago
Second wave of Gogs zero-day attacks begins
Researchers observed a renewed wave of exploitation starting on November 1, 2025, showing the campaign was ongoing months after initial abuse began. Reports describe the activity as automated and likely conducted by a single actor or group.
Oct 1, 20251y ago
Gogs maintainers acknowledge the reported vulnerability
According to later reporting, Gogs maintainers acknowledged Wiz's report in October 2025, but no patch had been released at that time. The issue remained unresolved despite prior responsible disclosure.
Jul 10, 20251y ago
Attackers begin exploiting CVE-2025-8110 against exposed Gogs servers
Evidence cited by multiple reports indicates exploitation began around July 2025, including suspicious repositories with random eight-character names created around July 10. The campaign targeted internet-exposed Gogs instances with open registration enabled.
Jul 1, 20251y ago
Wiz discovers Gogs symlink bypass zero-day and reports it to maintainers
Wiz Research discovered CVE-2025-8110 in Gogs during a malware investigation and responsibly disclosed the issue to Gogs maintainers in July 2025. The flaw is a symlink-based bypass of the earlier CVE-2024-55947 protections and can lead to remote code execution.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Gogs PutContents API Symlink Traversal Leading to Remote Code Execution (CVE-2025-8110)

Affected products

1 linked

Gogs

Organizations

1 linked

Gogs

Observables

6 linked

IPv4 address•••.••.•••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

19 references tracked. Mallory keeps watching after this page renders.

Oss Security Mailing ListNews · Dec 11, 2025

Re: CVE-2025-8110 in Gogs self-hosted git serviceOpen source ↗

Oss Security Mailing ListNews · Dec 11, 2025

Re: CVE-2025-8110 in Gogs self-hosted git serviceOpen source ↗

Cyber Security NewsNews · Dec 11, 2025

Gogs 0-Day Vulnerability Exploited in the Wild to Hack 700+ InstancesOpen source ↗

Dark ReadingNews · Dec 11, 2025

Attackers Exploited Gogs Zero-Day Flaw for MonthsOpen source ↗

11 additional sources from 10-12-2025 to 11-12-2025

Wiz BlogNews · Dec 10, 2025

Gogs 0-Day Exploited in the WildOpen source ↗

SecalertsNews · Dec 10, 2025

CVE-2025-8110: File overwrite in file update API in GogsOpen source ↗

Tenable Cve FeedNews · Dec 10, 2025

CVE-2025-8110Open source ↗

Wiz BlogNews · Dec 10, 2025

Gogs 0-Day Exploited in the WildOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilityinternet-facing-service-vulnerabilityinternet-exposed-servicedetection-content-update

Remote Code Execution via File Overwrite in Gogs PutContents API

Active Exploitation · 19 sources · Updated 4mo ago · First seen Dec 10, 2025

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jul 1, 2025 – Dec 11, 2025

Dec 11, 202511mo ago
Forgejo and Gitea are reported likely unaffected
In an oss-security follow-up on December 11, 2025, a Forgejo developer said the relevant code in Gitea, and therefore Forgejo, had previously been rewritten and attack attempts had not succeeded. This indicated the notable Gogs forks were most likely not affected by CVE-2025-8110.
Dec 10, 202511mo ago
Reports detail Supershell malware use and scale of compromise
Public reporting on December 10-11, 2025 tied the exploitation to Supershell C2 malware and estimated that over 700 of roughly 1,400-1,500 internet-facing Gogs instances showed signs of compromise. Researchers said the attacks appeared opportunistic, widespread, and likely run by a single actor or group.
Dec 10, 202511mo ago
CVE-2025-8110 is published in vulnerability databases
On December 10, 2025, CVE-2025-8110 was formally published with high-severity scoring and descriptions of the PutContents API symlink handling flaw in Gogs. Public proof-of-concept and technical details were also referenced by vulnerability feeds.
Dec 10, 202511mo ago
Wiz publicly discloses active exploitation of CVE-2025-8110
Wiz published research on December 10, 2025 describing CVE-2025-8110 as an actively exploited Gogs zero-day affecting version 0.13.3 and earlier. The disclosure said more than 700 public-facing instances had been compromised, no patch was yet available, and published indicators of compromise and mitigations were provided.
Nov 1, 20251y ago
Second wave of Gogs zero-day attacks begins
Researchers observed a renewed wave of exploitation starting on November 1, 2025, showing the campaign was ongoing months after initial abuse began. Reports describe the activity as automated and likely conducted by a single actor or group.
Oct 1, 20251y ago
Gogs maintainers acknowledge the reported vulnerability
According to later reporting, Gogs maintainers acknowledged Wiz's report in October 2025, but no patch had been released at that time. The issue remained unresolved despite prior responsible disclosure.
Jul 10, 20251y ago
Attackers begin exploiting CVE-2025-8110 against exposed Gogs servers
Evidence cited by multiple reports indicates exploitation began around July 2025, including suspicious repositories with random eight-character names created around July 10. The campaign targeted internet-exposed Gogs instances with open registration enabled.
Jul 1, 20251y ago
Wiz discovers Gogs symlink bypass zero-day and reports it to maintainers
Wiz Research discovered CVE-2025-8110 in Gogs during a malware investigation and responsibly disclosed the issue to Gogs maintainers in July 2025. The flaw is a symlink-based bypass of the earlier CVE-2024-55947 protections and can lead to remote code execution.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →