File overwrite in file update API in Gogs (CVE-2025-8110)

What is affected, what to do

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Gogs lte *..0.13.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Cut exposure now: Restrict every internet-facing Gogs instance (default HTTP 3000/tcp, often fronted on 443/tcp; SSH Git usually 22/tcp or 2222/tcp) to VPN or internal source ranges at the firewall or reverse proxy until a fixed build is confirmed.
   • Patch: Version 0.13.3 is listed as affected. A patch is available from the vendor — look up the fixed version in the vendor advisory / Gogs GitHub releases and confirm it addresses symlink handling in the PutContents API before rollout.
   • Disable open sign-up: In app.ini under [service] set DISABLE_REGISTRATION = true (optionally REQUIRE_SIGNIN_VIEW = true) and restart. Exploitation only needs an ordinary account with write access to a repository the attacker owns.
   • Hunt for compromise: Enumerate recently created users and repositories (randomly named ones are a red flag); search the repository root for symlinks (find /data/gogs-repositories -type l -ls) and inspect each bare repo config for unexpected entries such as sshCommand or other core.* settings.
   • If anything turns up, isolate and rotate: Take the host off the network, preserve a forensic image, then treat every secret held by Gogs as burned — deploy keys, access tokens, webhook secrets, the DB password in app.ini, SSH host keys — and reissue them.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place Gogs in its own segment and default-deny egress from the host (allowlist only mail relay, mirror sources, etc.). This blocks payload staging and reverse shells after code execution.
   • WAF / reverse proxy: Restrict PUT and POST on /api/v1/repos/*/*/contents/* to trusted networks or service accounts, or block them outright if web-API file edits aren't operationally required.
   • IAM / least privilege: Disable unknown or unused accounts, limit repository creation for regular users (MAX_CREATION_LIMIT = 0 where workable), and enforce 2FA on admin accounts.
   • Host hardening: Run Gogs under a dedicated unprivileged account; keep app.ini and custom/conf read-only to the service. In containers: read-only root filesystem, no-new-privileges, no Docker socket mounts.
   • Strategic decision: Given the project's patch cadence, evaluate migrating to an actively maintained alternative; until then, do not run internet-exposed Gogs with self-registration enabled.
3. 03

   Runbook step 3

   Detection rules

   • EDR / Sysmon process ancestry: Child processes of the Gogs binary (gogs web) or of git running as the Gogs service account that spawn shells or downloaders (sh, bash, curl, wget, python, nc). Sigma shape: ParentImage|endswith: '/gogs' AND Image|endswith: ['/sh','/bash','/curl','/wget']. On Linux use Sysmon for Linux EID 1 or auditd execve with the Gogs PID as ppid.
   • Web / proxy access logs: PUT /api/v1/repos/<owner>/<repo>/contents/<path> shortly after repo creation (POST /api/v1/user/repos) from the same account or source IP. SPL idea: index=proxy uri_path="/api/v1/repos/*/contents/*" method=PUT | stats count by src_ip, user, uri_path.
   • File integrity (auditd): Writes by the Gogs account to bare-repo config files or to paths outside the repository tree: -w /data/gogs-repositories -p wa -k gogs_repo_write; alert on hits against */config that introduce a sshCommand line.
   • Gogs application log: Bursts of new sign-ups, repos with random-looking names, and immediate commits containing symlink objects (Git mode 120000). Per-repo check: git ls-tree -r HEAD | grep '^120000'.
   • Network telemetry (Zeek / Suricata): New outbound connections from the Gogs host to unfamiliar destinations — long-lived sessions or ELF downloads (files.log with mime_type ELF) — right after API write activity.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), CISA KEV Catalog, CVE.org (MITRE), cvelistv5

Vendors and products

• Gogs Gogs

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• GitHub Security Advisoriesadvisories/GHSA-mq8m-42gh-wq7radvisory
• NVD (NIST)vuln/detail/CVE-2025-8110advisory
• wiz.ioblog/wiz-research-gogs-cve-2025-8110-rce-exploitweb
• openwall.comlists/oss-security/2025/12/11/3web
• openwall.comlists/oss-security/2025/12/11/4web
• github.comgogs/gogs/pull/8078Issue tracking
• github.comgogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6Patch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110government-resource
• openwall.comlists/oss-security/2026/01/17/4
• openwall.comlists/oss-security/2026/01/18/1
• openwall.comlists/oss-security/2026/01/18/2
• github.comgogs/gogs/pull/8082web
• github.comgogs/gogspackage

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

One NVD translation into another language is hidden.