CVE-2025-8110 is a critical Improper Symbolic Link Handling vulnerability in the PutContents API of Gogs, affecting all versions of the Gogs Git service. This flaw allows for Local Execution of Code, posing a significant risk to affected systems. With a CVSS score of 8.8 (HIGH), it has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog, and has garnered substantial community discussion and media coverage, including reports of its use to breach hundreds of servers. While no Metasploit or ExploitDB modules exist, Nuclei templates for remote code execution are available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 0.13.3CPE match | cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* | ||
<= 0.13.3CPE matchmatch criteria | cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.