CVE-2025-8110

CVE-2025-8110 is a path-traversal flaw (CWE-22) caused by improper symbolic-link handling in the PutContents API of the self-hosted Git service Gogs. An attacker with low-privileged access to the API can abuse symlinks so that file operations escape the intended directory, resulting in code execution on the server hosting Gogs. Because the attack works over the network with only low privileges and no user interaction, any Gogs deployment whose API is reachable — particularly internet-facing instances — is exposed. This is a zero-day: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-12 after reports of active attacks against 700+ instances, and at the time of the KEV listing no official patch was available, though a fix was in progress in Gogs pull request #8078. EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and CISA's required action is to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

What to do: Because no official patch was released at the time of the KEV listing, track gogs/gogs PR #8078 and upgrade to the fixed release as soon as it ships; in the interim, follow CISA's required action by applying vendor mitigations or restricting or discontinuing internet exposure of Gogs instances. Reduce attack surface by limiting low-privileged account access to the PutContents/write APIs and firewalling Gogs servers, and hunt for indicators of compromise on any internet-facing Gogs deployment given confirmed attacks against 700+ instances.