CVE-2025-8110 PoC — File overwrite in file update API in Gogs

Source

Associated Vulnerability

Description

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a symlink pointing to sensitive targets, leading to remote code execution. As of December 2025, this remains an unpatched zero-day with active exploitation ongoing. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise. The vulnerability stems from the API writing to file paths without checking if targets are symlinks pointing outside the repository. Gogs maintainers are working on a fix.

File Snapshot

 id: CVE-2025-8110

info:
  name: Gogs <= 0.13.3 - Remote Code Execution
  author: rxerium
  severity

...

Remarks