CVE-2025-8110: Gogs PutContents API symlink handling allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-term due date, has a very high EPSS score, public exploit references and a patch, and yields remote code execution from a low-privileged account.

What it is

The PutContents API in Gogs mishandles symbolic links, letting a user write file content through a symlink and escape the intended repository path (CWE-22 path traversal). Because the write lands outside the repository, an attacker can place executable content that the server later runs, turning a file-write primitive into local code execution. The flaw is remotely reachable over the network and is listed in CISA KEV, so it warrants urgent attention.

Impact

An attacker with a valid low-privileged account gains code execution in the context of the Gogs server process, which can expose repository data, credentials and the host itself. CVSS 4.0 scores confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through the PutContents API (CVSS 4.0 vector AV:N/PR:L/UI:N), so a low-privileged authenticated account is required but no user interaction is needed. No pre-authentication path is described in the record.

Exploitation

CISA added it to KEV on 2026-01-12 with a 2026-02-02 remediation due date, and EPSS gives a 30-day probability of 0.82471 (99.6th percentile). A public exploit write-up and a patch pull request are referenced, so exploitation is active and tooling is public.

What to do

• Apply the vendor patch (commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6 / PR 8078) or upgrade to a fixed Gogs release immediately.
• If patching is not possible, restrict or disable the PutContents API and limit repository write access to trusted accounts.
• Follow CISA KEV required action and BOD 22-01 guidance, including discontinuing use of the product if no mitigation is available.
• Audit Gogs accounts and tokens, remove unused or over-privileged ones, and rotate credentials that may have been exposed.
• Run Gogs with least privilege and isolate it from sensitive hosts and data so code execution does not reach critical systems.

Detection

• Monitor Gogs API logs for PutContents requests, especially writes involving symlinks or paths outside the repository root.
• Alert on new or modified executable files appearing outside expected repository directories on the Gogs host.
• Watch for unexpected child processes spawned by the Gogs server process.
• Review file integrity monitoring and audit logs for symlink creation followed by writes to sensitive paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.