CVE-2025-8110

Dec. 12, 2025, 3:18 p.m.

8.7
High

Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Product(s) Impacted

Product Versions
gogs
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
http://www.openwall.com/lists/oss-security/2025/12/11/3
http://www.openwall.com/lists/oss-security/2025/12/11/4

Tags

CWE-22
9947ef80-c5d5-474a-bbab-97341a59000e
2025-12-10
CVE-2025-8110

CVSS Score

8.7 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
  • Exploit Maturity: ATTACKED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X

    View Vector String

Timeline

Published: Dec. 10, 2025, 2:16 p.m.
Last Modified: Dec. 12, 2025, 3:18 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

9947ef80-c5d5-474a-bbab-97341a59000e

Relations

Here is the list of observables linked to the vulnerability CVE-2025-8110 using threat intelligence.

  • Supershell

Linked Attack Reports

Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited

A zero-day vulnerability in Gogs, a popular self-hosted Git service, has been discovered and is being actively exploited. The flaw, identified as CVE-2025-8110, is a symlink bypass of a previously patched RCE vulnerability. It allows authenticated users to overwrite files outside the repository, le…
vulnerability
zero-day
cloud security
supershell
rce
CVE-2024-55947
2025-12-10
CVE-2025-8110
git service
gogs
symlink bypass
Published: December 10, 2025
Linked vulnerabilities : CVE-2024-54148 (CVSS 9.8), CVE-2024-55947, CVE-2023-46747, CVE-2024-56731 (CVSS 10.0), CVE-2025-55182 (CVSS 10.0), CVE-2025-8110 (CVSS 8.7)
Downloadable IOCs: 0

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.