{"id":"CVE-2025-8110","title":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","summary":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"gogs","product":"gogs","affected":["gogs <= 0.13.3"],"published":"2025-12-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-8110","references":[{"url":"http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","label":"9947ef80-c5d5-474a-bbab-97341a59000e"},{"url":"http://www.openwall.com/lists/oss-security/2025/12/11/3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2025/12/11/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/17/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/18/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/18/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/gogs/gogs/pull/8078","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.85202,"epssPercentile":0.99714,"kev":true,"kevDateAdded":"2026-01-12","kevDueDate":"2026-02-02","kevRansomware":false,"exploited":true,"exploits":{"github":21,"githubRepos":["https://github.com/zAbuQasem/gogs-CVE-2025-8110","https://github.com/rxerium/CVE-2025-8110","https://github.com/Ghxstsec/CVE-2025-8110"],"nuclei":["CVE-2025-8110"],"checkedAt":"2026-10-14T21:57:39.241Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T21:57:04.782Z","slug":"CVE-2025-8110","body":"## Overview\n\nImproper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.\n\n## Affected\n\n- `gogs <= 0.13.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":90,"depthScoreParts":{"impact":48.4,"likelihood":17,"exploitation":25,"ransomware":0},"changes":[]}