CVE-2025-8110: 
Gogs vulnerability analysis and mitigation

CVE-2025-8110 is a symlink path traversal vulnerability in the PutContents API of Gogs, a self-hosted Git service written in Go, that allows authenticated users to achieve Remote Code Execution (RCE). It is effectively a bypass of a previously patched RCE vulnerability (CVE-2024-55947) and affects all Gogs versions up to and including 0.13.3. The vulnerability was discovered by Wiz Research on July 10, 2025, during investigation of a malware infection, and was publicly disclosed on December 10, 2025. A patch was released in version v0.13.4 on January 23, 2026. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Wiz Research, Github Advisory).

The root cause is improper symbolic link handling (CWE-22 — Path Traversal) in the UpdateRepoFile function of Gogs' PutContents API. While the fix for CVE-2024-55947 added path validation to prevent directory traversal via ../ sequences, it failed to account for symbolic links committed to a repository. Git natively allows symbolic links in repositories, and those symlinks can point to locations outside the repository directory. An attacker with repository write access can commit a symlink pointing to a sensitive target (e.g., .git/config), then use the PutContents API to write arbitrary content through the symlink — bypassing the path validation entirely because the API writes to the resolved symlink destination without checking whether it escapes the repository boundary. By overwriting .git/config and injecting an sshCommand, the attacker can force arbitrary command execution on the next git operation. The fix in commit 553707f adds a hasSymlinkInPath() function that traverses the full path hierarchy and rejects any operation involving a symlink (Wiz Research, Gogs Commit).

Successful exploitation grants an authenticated attacker full Remote Code Execution with the privileges of the Gogs process on the host system, resulting in complete compromise of confidentiality, integrity, and availability. Attackers can read sensitive files, overwrite system configurations, establish persistent backdoors, and pivot to other systems accessible from the compromised host. Wiz Research confirmed over 700 publicly exposed Gogs instances were compromised in the wild, with source code repositories and potentially proprietary intellectual property exposed to theft or destruction (Wiz Research, Github Advisory).

CVE-2025-8110 has been actively exploited in the wild since at least July 10, 2025 — months before public disclosure — making it a true zero-day at the time of discovery. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on January 12, 2026, and ordered federal agencies to patch (CISA KEV). Multiple public PoC exploits are available on GitHub, and the Supershell C2 malware framework has been weaponized to exploit this vulnerability, with the C2 server identified at 119.45.176[.]196 (Wiz Research). Recorded Future also identified this vulnerability as part of December 2025's critical CVE landscape, noting its use in APT-linked campaigns (Recorded Future). The EPSS score is approximately 0.079% per NVD data, though the GitHub Advisory Database EPSS estimate is significantly higher at 17.7%. The attack is automatable and requires only low privileges (a registered account), making mass exploitation trivial on instances with open registration enabled.

1. Reconnaissance: Identify publicly exposed Gogs instances (version ≤ 0.13.3) using Shodan or Censys. Prioritize instances with open registration enabled (the default setting), which allows self-service account creation.
2. Account Creation: Register a new user account on the target Gogs instance via the open registration feature, or use existing credentials.
3. Create a Repository: Create a new Git repository on the Gogs instance to serve as the attack staging ground.
4. Commit a Malicious Symlink: Clone the repository locally, create a symbolic link pointing to a sensitive target outside the repository (e.g., ln -s /path/to/repo/.git/config evil_link), commit and push the symlink to the remote repository.
5. Exploit PutContents API: Send a crafted HTTP PUT request to the Gogs API endpoint /api/v1/repos/<owner>/<repo>/contents/<symlink_name> with a malicious payload in the content field (base64-encoded). The API follows the symlink and writes the content to the target file outside the repository.
6. Inject sshCommand for RCE: Overwrite .git/config with a modified configuration containing a malicious sshCommand entry (e.g., pointing to a reverse shell script). On the next git SSH operation triggered by the server, the injected command executes with Gogs process privileges.
7. Deploy Payload: The observed threat actor deployed the Supershell C2 framework, establishing a reverse SSH shell for persistent remote access and arbitrary command execution (Wiz Research, Gogs PR #8078).

• Network:

  • Outbound connections to known Supershell C2 server: 119.45.176[.]196
  • Outbound connections to payload delivery servers: 106.53.108[.]81, 119.91.42[.]53
  • Unusual HTTP PUT requests to /api/v1/repos/<owner>/<repo>/contents/<path> targeting symlink filenames

• File System:

  • Malware binaries with SHA-1 hashes: d8fcd57a71f9f6e55b063939dc7c1523660b7383 and efda81e1100ea977321d0f2eeb0dfa7a6b132abd
  • Modified .git/config files containing unexpected sshCommand entries
  • Symbolic links in repository directories pointing to paths outside the repository

• Logs / Repository Activity:

  • Repositories with random 8-character alphanumeric names created within a short time window (pattern observed in July 2025 campaign)
  • Multiple repositories created by newly registered accounts in rapid succession
  • Gogs access logs showing PUT API calls to file paths that are symbolic links

• Process:

  • Unexpected child processes spawned by the Gogs service process (e.g., reverse shells, ssh, curl, wget)
  • UPX-packed Go binaries (compiled with garble) executing on the host
  • Supershell framework processes establishing reverse SSH tunnels (Wiz Research)

Primary Remediation: Upgrade Gogs to version v0.13.4 or later, which includes the fix that rejects any repository update involving a symlink in the path hierarchy (commit 553707f) (Gogs Commit). CISA has mandated that federal agencies apply this patch by the KEV deadline (CISA KEV).

Immediate Workarounds (if upgrade is not immediately possible):

• Disable open registration: Prevent untrusted users from creating accounts, significantly reducing the attack surface.
• Restrict internet exposure: Place the Gogs instance behind a VPN or implement IP allowlisting to limit access to trusted users only.
• Restrict repository write access: Limit repository creation and write permissions to verified, trusted users.
• Monitor for IOCs: Audit for repositories with random 8-character names and unexpected PutContents API usage.

Wiz Research, who discovered and disclosed the vulnerability, published a detailed technical blog post on December 10, 2025, describing the attack chain, in-the-wild exploitation evidence, and malware analysis (Wiz Research). The disclosure generated significant community discussion on Reddit (r/programming, r/linux, r/blueteamsec), Hacker News, and Mastodon, with many users expressing concern about the months-long exploitation window before public disclosure. Security media including BleepingComputer, The Register, SecurityWeek, The Hacker News, and Security Affairs covered the story extensively, highlighting that over 700 instances were compromised before a patch was available. CISA's January 12, 2026 KEV addition and mandatory patching order for federal agencies amplified media attention further. The oss-security mailing list also saw discussion about whether Gogs forks (Gitea, Forgejo) were affected (oss-security). Hunt.io linked the exploitation infrastructure to China-hosted malware C2 networks (Hunt.io).