CVE-2025-8110

Gogs Path Traversal Vulnerability

Gogs Gogs

CVSS

8.7High

ExploitationExploited in the wildAdded to KEV 12 Jan 2026CISA KEV

Exploit odds (EPSS)85.2%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Federal deadline2 Feb 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

10 Dec 2025, 13:23 UTCPublishedCVE List
12 Jan 2026Added to CISA KEVCISA KEV

Public exploit code and templates 1

Scanner templateGogs <= 0.13.3 - Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

Text from CVE List

Affected versions 1

Gogsaffected: all versions through 0.13.3CVE List