CISA reports active exploitation of a Gogs vulnerability

The US Cybersecurity and Infrastructure Security Agency has added a high-severity Gogs vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. CVE-2025-8110 carries a CVSS score of 8.7 and stems from improper handling of symbolic links in the PutContents API of Gogs, which can lead to remote code execution by authenticated users. The flaw bypasses protections introduced for an earlier issue, CVE-2024-55947, by permitting files outside the repository to be overwritten via a crafted symbolic link. All versions up to and including 0.13.3 are affected, and no official patch was available at the time of writing. CISA directs federal agencies to apply mitigations under directive BOD 22-01.

What this means for your organisation

Gogs is a widely deployed self-hosted Git service written in Go, and it often sits in a development environment without the oversight applied to business systems. When the source repository can be taken over, both the code and the build chain are at stake. With no patch available, compensating controls must be considered rather than waiting for an update.

Berigo recommends

• Determine whether Gogs is in use internally, including in legacy or unofficial development environments.
• Restrict who can authenticate to the service and remove any internet exposure.
• Track vendor updates and apply compensating controls in the meantime.
• Use the KEV catalog as a standing input to your own vulnerability management.

Source

• cisa.gov
• cisa.gov
• cve.org