CVE-2025-8110: Gogs Path Traversal Vulnerability

KEV

Analyzed

AliasesGHSA-mq8m-42gh-wq7rGO-2025-4225

Published 10-12-2025Last modified 26-02-2026

Vulnerability summary

CVE-2025-8110 is a high (CVSS 8.8) vulnerability in Gogs. It is known to be exploited: CISA lists it, first on 12-01-2026. EPSS estimates a 85.20% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (12-01-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.8/10

010

High · v3.1 (NVD)

EPSS score

85.20%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0037-1

Timeline

10-12-2025
PublishedVulnerability first disclosed.
12-01-2026
Added to CISA KEVExploitedGogs Path Traversal Vulnerability
02-02-2026
CISA remediation dueDeadline passedApply mitigations per vendor instructions.
26-02-2026
Last modifiedVulnerability information updated.

Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVSS metrics

4 scores · 3 sources · 2 versions

v4.08.7v3.18.8

EPSS trend

Probability

85.20%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 85.20% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 12-01-2026
Federal due date: 02-02-2026

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 nvd.nist.gov/vuln/detail/CVE-2025-8110

Public exploits

2 found

githubUnverified
Gogs
Maturity: poc
referenceUnverified
Exploit Reference (wiz.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Gogs1 product

gogs≤ 0.13.3

Gogs.io1 product

gogs≤ 0.13.3 | All versions (No fix recorded)

2 vendors · 2 products

References

13 links

wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploitWEBExploitThird Party Advisory
github.com/gogs/gogs/pull/8078Issue TrackingWEBExploitPatchVendor Advisory
github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6PatchWEB
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110Government ResourceWEBThird Party AdvisoryUS Government Resource
www.openwall.com/lists/oss-security/2025/12/11/3WEBMailing List
www.openwall.com/lists/oss-security/2025/12/11/4WEBMailing List
www.openwall.com/lists/oss-security/2026/01/17/4WEBMailing List
www.openwall.com/lists/oss-security/2026/01/18/1WEBMailing List
www.openwall.com/lists/oss-security/2026/01/18/2WEBMailing List
nvd.nist.gov/vuln/detail/CVE-2025-8110Advisory

Show all 13 references

github.com/gogs/gogs/pull/8082WEB
github.com/advisories/GHSA-mq8m-42gh-wq7rAdvisory
github.com/gogs/gogsPACKAGE