CISA Flags Actively Exploited Gogs Path Traversal Leading to RCE (CVE-2025-8110)

CISA added CVE-2025-8110 affecting the Gogs self-hosted Git service to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and triggering mandatory remediation timelines for U.S. Federal Civilian Executive Branch (FCEB) agencies under BOD 22-01. The issue is described as a path traversal weakness that can be leveraged for remote code execution (RCE) in real-world attacks, increasing risk for organizations running Internet-exposed Gogs instances.

Technical reporting indicates the flaw resides in the PutContents API and can be abused by authenticated attackers using symbolic links to write outside a repository and overwrite sensitive files; one described route to code execution is overwriting Git configuration (e.g., sshCommand) to force arbitrary command execution. Wiz Research tied the vulnerability to observed malware activity on an Internet-facing Gogs server and reported large-scale exposure and compromise signals across the ecosystem (including thousands of exposed servers and hundreds showing signs of compromise), with exploitation observed as a zero-day prior to patch availability; CISA’s KEV action formalizes the exploitation status and elevates patching priority for both government and non-government operators.