CVE-2025-8110

Gogs is a self-hosted tool for managing Git repositories. This bug lets an attacker trick Gogs into writing to the wrong place on the server by abusing how it follows symbolic links during a “file update” action. In the worst case, that means the attacker can overwrite files they shouldn’t and potentially take control of your server or corrupt your code/data.

This matters if your business runs Gogs (gogs.io/gogs) and an attacker can reach the vulnerable file-update feature (the PutContents API). The findings indicate low authentication is required and no user interaction is needed, so the risk is higher if the service is exposed to the internet or accessible by untrusted users/networks. KEV confirms it’s a real, actionable issue for environments that can reach the vulnerable functionality.

This is RED because CISA KEV confirms real-world risk and provides a specific remediation deadline. Attackers can exploit it to overwrite files via the PutContents API (using symbolic-link abuse), which can lead to code execution and major data compromise. The situation is urgent: prioritize upgrade or vendor-recommended mitigations immediately and do not wait.

1. Confirm exposure

   • Identify whether you run Gogs (gogs.io/gogs) and determine the exact running version.
   • Identify how your Gogs is exposed (public internet, VPN-only, internal-only) and which users/roles can access repository/file update features.

2. Check for the vendor fix

   • Apply the vendor remediation changes from:
     • gogs/gogs commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6, or
     • gogs/gogs pull/PR 8078.
   • Upgrade to the patched release that contains those changes (your vendor/packaging system should provide a “fixed version”; if you can’t map it, apply the upstream changes directly and validate with tests).

3. If you cannot upgrade right away (temporary containment)

   • Use an application firewall/WAF to filter and block suspicious traffic patterns to Gogs endpoints involved in file updating, aligned with the vendor’s guidance.
   • Restrict network access to Gogs so only trusted networks/users can reach it (for example: lock down to VPN/IP allowlists).

4. Validate after remediation

   • Retest normal Git/repository operations in Gogs.
   • Review logs around the time of any suspicious activity, especially requests that look like file content updates to the PutContents API.

5. Follow the KEV timeline

   • CISA KEV remediation due date: 2026-02-02.
   • Maintain evidence of the upgrade/mitigation actions taken for audit purposes.

Severity/impact: High risk (CVSS 8.8). The core weakness is CWE-22 (path traversal/file overwrite class issues), specifically via improper symbolic-link handling in the Gogs PutContents API. Mechanism: an attacker can abuse the API’s handling of symbolic links to overwrite arbitrary files on the server, which can enable code execution or at least serious data corruption.

Reachability/authentication: Low authentication required; no user interaction needed. The specific “reachable in default config” and “preconditions” are not known from the findings, but KEV indicates there is an actionable scenario in real environments where the vulnerable functionality can be reached.

Exploitation status: Listed in CISA KEV (added 2026-01-12), with a CISA remediation due date of 2026-02-02—this is treated as confirmed real-world risk.

Exploit maturity: Public PoC exists (2 known). Patch availability: vendor remediation is provided via upstream commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6 and PR 8078, plus recommended WAF-based mitigation.

KEV meaning here: CISA KEV listing indicates this vulnerability has been prioritized as being actively relevant, with required actions for federal and guided remediation expectations (and a deadline).

Note on EPSS: A high EPSS was reported with a rising trend, but KEV confirmation takes precedence for urgency decisions.