MSRXVulnerabilities / CVE-2025-8110
CVE-2025-8110
Published 2025-12-10 · published (not yet in NVD)
CVE-2025-8110
File overwrite in file update API in Gogs
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-12, with a fix-by date of 2026-02-02. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
8.7 HIGH
CVSS 4.0 · CNA
CVSS 4.0 · CNA
85%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| gogs.io/gogs | Go | no fix listed |
Affected products
- Gogs Gogs: 0 to ≤ 0.13.3
Weakness: CWE-22
Also known as: GHSA-mq8m-42gh-wq7r, GO-2025-4225
1 references (advisories, patches, write-ups)
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.