CVE-2025-8110

Gogs is a self-hosted tool for managing Git repositories. This bug lets an attacker trick Gogs into writing to the wrong place on the server by abusing how it follows symbolic links during a “file update” action. In the worst case, that means the attacker can overwrite files they shouldn’t and potentially take control of your server or corrupt your code/data.

This matters if your business runs Gogs (gogs.io/gogs) and an attacker can reach the vulnerable file-update feature (the PutContents API). The findings indicate low authentication is required and no user interaction is needed, so the risk is higher if the service is exposed to the internet or accessible by untrusted users/networks. KEV confirms it’s a real, actionable issue for environments that can reach the vulnerable functionality.

This is RED because CISA KEV confirms real-world risk and provides a specific remediation deadline. Attackers can exploit it to overwrite files via the PutContents API (using symbolic-link abuse), which can lead to code execution and major data compromise. The situation is urgent: prioritize upgrade or vendor-recommended mitigations immediately and do not wait.