---
id: CVE-2025-8110
title: >-
  Improper Symbolic link handling in the PutContents API in Gogs allows Local
  Execution of Code.
summary: >-
  Improper Symbolic link handling in the PutContents API in Gogs allows Local
  Execution of Code.
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
vendor: gogs
product: gogs
affected:
  - gogs <= 0.13.3
published: '2025-12-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8110'
references:
  - url: 'http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit'
    label: 9947ef80-c5d5-474a-bbab-97341a59000e
  - url: 'http://www.openwall.com/lists/oss-security/2025/12/11/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/12/11/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/01/17/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/01/18/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/01/18/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/gogs/gogs/pull/8078'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.85202
epssPercentile: 0.99714
kev: true
kevDateAdded: '2026-01-12'
kevDueDate: '2026-02-02'
kevRansomware: false
exploited: true
exploits:
  github: 21
  githubRepos:
    - 'https://github.com/zAbuQasem/gogs-CVE-2025-8110'
    - 'https://github.com/rxerium/CVE-2025-8110'
    - 'https://github.com/Ghxstsec/CVE-2025-8110'
  nuclei:
    - CVE-2025-8110
  checkedAt: '2026-10-14T21:57:39.241Z'
exploitAvailable: true
ingestedAt: '2026-10-14T21:57:04.782Z'
---

## Overview

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

## Affected

- `gogs <= 0.13.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.