CVE-2025-8110: Gogs symlink path traversal leads to code execution, in CISA KEV
The short version: Gogs — the self-hosted Git service — mishandles symbolic links in its PutContents API (CVE-2025-8110), letting an authenticated user write outside the intended directory and reach code execution on the host. It's listed in CISA's KEV catalog. Patch and reduce your auth bar. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — KEV-listed, post-auth path to code execution |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS v4.0 (NVD) | 8.7 — High |
| EPSS | ~76.54% · 99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-02-02 |
| Known exploited? | Yes — listed in CISA KEV; public exploit research (Wiz) |
| Vulnerability type | CWE-22 path traversal (improper symlink handling) → local code execution |
| Requires authenticated session? | Yes — an authenticated user |
| Affected | Gogs through 0.13.3 |
| Fixed in | See the Gogs release notes — patched via the project's fix commit (PR #8078) |
What you need to know
Gogs' PutContents API doesn't safely handle symbolic links. By crafting a symlink, an authenticated attacker can escape the intended repository directory and write to locations they shouldn't be able to — and that write primitive can be turned into code execution on the server.
Why it's worth prioritizing despite requiring an account:
- It's KEV-listed. CISA added it with a federal remediation deadline, so exploitation is more than theoretical.
- The auth bar is often low. Gogs instances that allow self-registration make "authenticated" easy to reach.
- The endpoint is a normal feature.
PutContentsis part of routine repository interaction, so no exotic access is needed once you're in.
How serious we see it
High.
The NVD scores it 8.8 (v3.1) and 8.7 (v4.0), and KEV status pulls it up our list. We stop short of Critical because exploitation requires an authenticated session — but on a self-registration-enabled instance, that gate is thin, so treat it accordingly. The bounded, reassuring part is that specific versions are affected, a fix is published in the project's releases, and exposure is quick to confirm.
Recommendations
Straight from the Gogs project and CISA:
- Patch now. Update Gogs to the fixed release (see the project's release notes for the version that includes the
PutContentssymlink fix). - Reduce the auth bar. Disable open self-registration on internet-facing instances.
- Hunt. Review for unexpected files written outside repository directories and for signs of code execution.
- Restrict exposure. Limit who can reach the Gogs instance from the internet.
- Confirm your exposure first. Verify whether you run an affected Gogs version.
How BreachRisk sees it
BreachRisk discovers internet-facing Gogs instances from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed CVE — surfaced at the top of your results because it's actively tracked as exploited. Because the flaw requires an authenticated session, we detect and flag the exposed, affected version rather than exploiting it.
That outside-in, continuous view means a self-hosted Git server is already mapped and version-checked when a KEV item like this lands.