CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution

CVE-2024-55947 is a path traversal flaw (CWE-22) in Gogs, an open source self-hosted Git service, that allows a malicious user to write a file to an arbitrary path on the server. It requires only low privileges, so any authenticated Gogs user can trigger it over the network without user interaction, and by planting a file in a sensitive location — such as the service account's SSH authorized_keys — the attacker gains SSH access to the host, effectively compromising the server (high confidentiality, integrity, and availability impact per CVSS). All Gogs deployments running versions prior to 0.13.1 are affected. Exploitation is no longer theoretical: recent reporting describes active attacks hitting 700+ instances, and CISA has flagged the flaw as actively exploited, adding it to its Known Exploited Vulnerabilities catalog. EPSS assigns a 75.2% probability of exploitation within 30 days (99th percentile), underscoring elevated risk for exposed instances.

Do: Upgrade all Gogs instances to 0.13.1 or later, which fixes this flaw, and treat the upgrade as urgent given active exploitation and the KEV listing. Check your deployed version, audit the host for rogue SSH keys and unexpected file writes (especially the git service account's authorized_keys), and review account activity and logs for signs of compromise. Until patched, limit network exposure of the Gogs service and the server's SSH port, and restrict account creation to trusted users.

CVE-2025-8110 is a path-traversal flaw (CWE-22) caused by improper symbolic-link handling in the PutContents API of the self-hosted Git service Gogs. An attacker with low-privileged access to the API can abuse symlinks so that file operations escape the intended directory, resulting in code execution on the server hosting Gogs. Because the attack works over the network with only low privileges and no user interaction, any Gogs deployment whose API is reachable — particularly internet-facing instances — is exposed. This is a zero-day: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-12 after reports of active attacks against 700+ instances, and at the time of the KEV listing no official patch was available, though a fix was in progress in Gogs pull request #8078. EPSS assigns an 82.5% probability of exploitation within 30 days (100th percentile), and CISA's required action is to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Do: Because no official patch was released at the time of the KEV listing, track gogs/gogs PR #8078 and upgrade to the fixed release as soon as it ships; in the interim, follow CISA's required action by applying vendor mitigations or restricting or discontinuing internet exposure of Gogs instances. Reduce attack surface by limiting low-privileged account access to the PutContents/write APIs and firewalling Gogs servers, and hunt for indicators of compromise on any internet-facing Gogs deployment given confirmed attacks against 700+ instances.