Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a symlink pointing to sensitive targets, leading to remote code execution. As of December 2025, this remains an unpatched zero-day with active exploitation ongoing. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise. The vulnerability stems from the API writing to file paths without checking if targets are symlinks pointing outside the repository. Gogs maintainers are working on a fix.
PoC
id: CVE-2025-8110
info:
name: Gogs <= 0.13.3 - Remote Code Execution
author: rxerium
severity: high
description: |
Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a symlink pointing to sensitive targets, leading to remote code execution. As of December 2025, this remains an unpatched zero-day with active exploitation ongoing. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise. The vulnerability stems from the API writing to file paths without checking if targets are symlinks pointing outside the repository. Gogs maintainers are working on a fix.
remediation: |
Update to the latest version of Gogs.
impact: |
Local attackers can execute arbitrary code, potentially leading to full system compromise.
reference:
- https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html
- https://github.com/advisories/ghsa-mq8m-42gh-wq7r
- https://nvd.nist.gov/vuln/detail/CVE-2025-8110
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2025-8110
epss-score: 0.82471
epss-percentile: 0.99646
cwe-id: CWE-22
metadata:
verified: true
vendor: gogs
product: gogs
max-request: 1
shodan-query: http.title:"Sign In - Gogs"
tags: cve,cve2025,gogs,git,symlink,rce,kev,vkev,passive,vuln
http:
- method: GET
path:
- "{{BaseURL}}/user/login"
extractors:
- type: regex
name: version
group: 1
regex:
- 'Gogs Version: ([0-9.]+)'
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(body, "Sign In - Gogs: Go Git Service")'
- 'compare_versions(version, "<= 0.13.3")'
condition: and
# digest: 4a0a00473045022052c07dd40c24d1b0975f3d86f4c4e3c8aa2d8de316afdeed10b14d1def6fbc9f022100dd0240cc2901cf231e57199203d8027a9cf2b536394789d55a0317deefbc291a:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.