CVE-2025-8110: Gogs Path Traversal Vulnerability
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Other sources
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services to mitigate risks for hosted instances of the Gogs (go/gogs.io/gogs) service.
- Compensating control
Discontinue use of the Gogs self-hosted git service (go/gogs.io/gogs) if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8110?
CVE-2025-8110 is classified as a critical vulnerability due to its potential for local code execution.
How do I mitigate CVE-2025-8110?
To mitigate CVE-2025-8110, update Gogs to the latest version where the vulnerability has been addressed.
What kind of exploit is associated with CVE-2025-8110?
CVE-2025-8110 involves improper symbolic link handling that can lead to local execution of code in the Gogs application.
Can CVE-2025-8110 affect my Gogs installation?
Yes, if you are using an affected version of Gogs, CVE-2025-8110 poses a risk to your application.
Is it possible to detect CVE-2025-8110 in my application?
You can detect CVE-2025-8110 by auditing your Gogs version and checking for any known indicators of compromise.