CVE-2025-8110
Gogs Path Traversal Vulnerability
Published Dec 10, 2025 · updated Oct 14, 2026 · gogs gogs
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · Catalog
Detected
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Jan 12, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Feb 2, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Oct 14, 2026 · NIST NVD
Updated
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Feb 2, 2026
Affected
- cpe gogs/gogsversion unspecified
- vendor Gogs Gogsversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2025-8110
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2025-8110
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-8110
30-day exploitation probability 85.2%
first.org - NIST NVDVulnerability recordCVE-2025-8110
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
nvd.nist.gov