CVE-2025-8110
KEVHIGH 8.8EPSS 82.7%
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
- CVSS v4.0
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X - CVSS v4.0
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 82.69% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2026-01-12
- Nuclei
- high ยท CWE-22
- Published
- 2025-12-10
- Updated
- 2026-02-26
Proof-of-concept exploits (18)
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- 0dgt/CVE-2025-8110
- 111ddea/goga-cve-2025-8110
- 3jee/CVE-2025-8110
- 9xh4kv/CVE-2025-8110
- AdityaInnovates/CVE-2025-8110-Gogs-RCE-Exploit
- George0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-Execution
- Ghxstsec/CVE-2025-8110
- Shirouuu/CVE-2025-8110-gogs-poc
- X4BROZER/CVE-2025-8110
- Xdezen/CVE-2025-8110
- hassan-hamadi/CVE-2025-8110-Silentium-HTB
- ixZODiAK/CVE-2025-8110
- joaquinrrr/CVE-2025-8110
- kayl22/cve-2025-8110-GOGS-RCE
- mananispiwpiw/CVE-2025-8110-PoC
- popyue/CVE-2025-8110
- zAbuQasem/gogs-CVE-2025-8110