Loading vulnerability…
Gogs PutContents API Symlink Traversal Leading to Remote Code Execution
CVE-2025-8110 is a symbolic-link-based path traversal vulnerability in the Gogs PutContents API and repository file editor. It bypasses protections introduced for CVE-2024-55947 because file operations do not adequately prevent following symbolic links outside the repository. An authenticated attacker can commit a symlink pointing to an external target and then use PutContents to overwrite that target. Overwriting security-sensitive Git configuration can lead to arbitrary code execution as the Gogs service account. Gogs 0.13.3 and earlier are reported affected. The vulnerability has been exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog on January 12, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises filesystem integrity beyond the attacker-controlled repository and can result in remote code execution with the privileges of the Gogs server process. Accessible repositories, application data, and other files writable by that account may be modified or compromised. The extent of host compromise depends on the service account’s permissions; elevated operating-system privileges are not inherently granted. Observed attacks compromised hundreds of Gogs instances and included deployment of Supershell command-and-control tooling.
If you can’t patch tonight, do this now.
Disable open user registration and restrict Gogs access through a VPN or network allow-list. Disabling registration reduces opportunities for attackers to obtain accounts but does not protect against existing malicious or compromised authenticated users. Avoid direct Internet exposure while remediation remains unverified.
Patch, then assume compromise.
Deploy a vendor-confirmed fix specifically addressing CVE-2025-8110. Gogs pull request #8082 was reported as a fix, but its completeness was questioned because separate symlink checks and subsequent filesystem operations may permit TOCTOU races. A definitive fixed release is not established by the available information. Robust remediation must prevent symlink traversal throughout path resolution and file creation, including intermediate path components, without relying solely on pre-operation checks. If an effective fix or adequate mitigations cannot be applied, discontinue use of the vulnerable deployment.
28 exploits validated by Mallory's analysis. Hidden: 5 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries. Showing the 25 most capable, earliest first.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
146 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.