Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited
Dec. 21, 2025, 6:57 p.m.
Description
A zero-day vulnerability in Gogs, a popular self-hosted Git service, has been discovered and is being actively exploited. The flaw, identified as CVE-2025-8110, is a symlink bypass of a previously patched RCE vulnerability. It allows authenticated users to overwrite files outside the repository, leading to Remote Code Execution. Over 700 compromised instances have been identified on the internet. The vulnerability affects Gogs servers (version <= 0.13.3) exposed to the internet with open-registration enabled. The attack chain involves creating a repository with a symbolic link, then using the PutContents API to overwrite sensitive files. The malware used in the attacks is based on the Supershell framework, designed for establishing reverse SSH shells.
Tags
Date
- Created: Dec. 10, 2025, 6:35 p.m.
- Published: Dec. 10, 2025, 6:35 p.m.
- Modified: Dec. 21, 2025, 6:57 p.m.