CVE-2025-8110

Published Dec 10, 2025

Last updated 10 days ago

Gogs

PutContents API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8110 is a vulnerability affecting Gogs, a self-hosted Git service. It involves improper handling of symbolic links in the PutContents API, which allows for local code execution. This flaw is a bypass of a previously patched remote code execution vulnerability, CVE-2024-55947. The vulnerability can be exploited by creating a symbolic link within a Git repository that points to a sensitive target outside the repository. By using the PutContents API to write data to the symlink, an attacker can overwrite files outside the repository. This can be leveraged to overwrite the ".git/config" file and execute arbitrary commands.

Description: Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Source: 9947ef80-c5d5-474a-bbab-97341a59000e
NVD status: Analyzed
Products: gogs

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Gogs Path Traversal Vulnerability
Exploit added on: Jan 12, 2026
Exploit action due: Feb 2, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

9947ef80-c5d5-474a-bbab-97341a59000e: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC3C1E01-690F-4BEB-8969-16883D7F12A5",
            "versionEndIncluding": "0.13.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.