PT-2025-50327 · Gogs · Gogs
CVE-2025-8110
·
Published
2025-10-30
·
Updated
2026-08-01
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Gogs versions prior to 0.13.0
Description
A path traversal flaw exists in the
PutContents API of Gogs, a self-hosted Git service. The issue stems from improper symbolic link handling, which allows authenticated attackers to bypass security boundaries and write arbitrary content to files outside the intended repository directory. This can lead to remote code execution (RCE) by overwriting sensitive files, such as git configuration files, cron jobs, hook scripts, or web application files. The flaw has been actively exploited in the wild as a zero-day, with over 700 known compromised instances globally. Attackers have used this mechanism for lateral movement, data theft, and source code exfiltration.Recommendations
Upgrade to Gogs version 0.13.0 or later.
Disable the
PutContents API.
Block PUT requests to the endpoint /api/v1/repos/*/contents/*.
Disable open user registration.
Restrict internet exposure to the server using VPNs or IP allow-listing.
Isolate affected systems and monitor logs for unusual PUT requests or unexpected file writes by the Gogs process.Exploit
Fix
DoS
RCE
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gogs