CVE-2025-8110
File overwrite in file update API in Gogs
KEVHIGH 8.7EPSS 85.2%
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
- Affected
- Gogs
- CVSS v4.0 CNA
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X - CVSS v4.0 GitHub
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A - CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 85.20% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2026-01-12
- Nuclei
- high · CWE-22
- Published
- 2025-12-10
- Updated
- 2026-02-26
Proof-of-concept exploits (19)
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- 0dgt/CVE-2025-81101★ · 2026-04-12
- 111ddea/goga-cve-2025-81100★ · 2025-12-24
- 3jee/CVE-2025-81102★ · 2026-04-11
- 9xh4kv/CVE-2025-81100★ · 2026-08-05
- AdityaInnovates/CVE-2025-8110-Gogs-RCE-Exploit0★ · 2026-04-12
- George0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-Execution1★ · 2026-02-10
- Ghxstsec/CVE-2025-81105★ · 2026-04-20
- Shirouuu/CVE-2025-8110-gogs-poc4★ · 2026-07-17
- X4BROZER/CVE-2025-81100★ · 2026-04-15
- Xdezen/CVE-2025-81100★ · 2026-07-16
- ixZODiAK/CVE-2025-81101★ · 2026-07-21
- joaquinrrr/CVE-2025-81105★ · 2026-06-25
- kayl22/cve-2025-8110-GOGS-RCE4★ · 2026-04-11
- mananispiwpiw/CVE-2025-8110-PoC0★ · 2026-05-20
- popyue/CVE-2025-81100★ · 2026-04-13
- zAbuQasem/gogs-CVE-2025-811030★ · 2025-12-24
- EduPuzon/Silentium0★ · 2026-09-13
- Makis6/CVE-2025-81100★ · 2026-10-01
Nuclei templates (1)
Security advisories
- gogs/gogs/pull/8078
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110
- advisories/GHSA-mq8m-42gh-wq7r