Back to CVE Browser

CVE-2025-8110

🔥 Known Exploited (CISA KEV)HIGH

8.7

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-12-10

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Affected Platforms (CPE)

📦

Gogs

Gogs

<= 0.13.3

References & Advisories

🔗 http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit

🔗 http://www.openwall.com/lists/oss-security/2025/12/11/3

🔗 http://www.openwall.com/lists/oss-security/2025/12/11/4

🔗 http://www.openwall.com/lists/oss-security/2026/01/17/4

🔗 http://www.openwall.com/lists/oss-security/2026/01/18/1

🔗 http://www.openwall.com/lists/oss-security/2026/01/18/2

🔗 https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6

🔗 https://github.com/gogs/gogs/pull/8078

Related Vulnerabilities

CVE-2025-562326.8

GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy ca...

CVE-2025-595377.5

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19,...

CVE-2025-479436.3

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scriptin...

CVE-2024-5673110.0

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git direct...