File overwrite in file update API in Gogs
Priority CRITICAL 97Exploited in the wildCWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Why it matters now
Exploitation Active In CISA KEV since 2026-01-12CISA due date 2026-02-02
EPSS 0.85202 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | gogs.io/gogs (Go) | up to 0.13.3 | — | No fix listed | GHSA-mq8m-42gh-wq7r |
- gogs.io/gogs (Go) Vendor— Affected up to 0.13.3 Fixed in — No fix listed GHSA-mq8m-42gh-wq7r
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-01-12 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-8110
- 2026-10-03 Alias added: GHSA-mq8m-42gh-wq7r
References
Exploit 2
Advisory 3
Other 7
- https://github.com/gogs/gogs/pull/8082
- https://github.com/gogs/gogs
- http://www.openwall.com/lists/oss-security/2025/12/11/3
- http://www.openwall.com/lists/oss-security/2025/12/11/4
- http://www.openwall.com/lists/oss-security/2026/01/17/4
- http://www.openwall.com/lists/oss-security/2026/01/18/1
- http://www.openwall.com/lists/oss-security/2026/01/18/2
More Gogs vulnerabilities
- TI-2022-01876 OS Command Injection in gogs/gogs CVSS 3.1CRITICAL 9.8
- TI-2024-36988 Gogs has a Path Traversal in file update API CVSS 4.0HIGH 8.7
- TI-2022-01744 Remote Command Execution in gogs/gogs CVSS 3.1CRITICAL 10.0
- TI-2025-39562 Gogs's update .git/config file allows remote command execution CVSS 4.0CRITICAL 9.3
- TI-2026-20951 Gogs: Cross-repository LFS object overwrite via missing content hash verification CVSS 3.1CRITICAL 9.3
- TI-2024-36263 Gogs has a Path Traversal in file editing UI CVSS 4.0HIGH 8.7
Sources
- CVE-2025-8110 · CVE Program
- CVE-2025-8110 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-mq8m-42gh-wq7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences