Gogs vulnerable to a bypass of CVE-2024-55947

HIGH 8.8EXPLOITED (CISA KEV)CVE-2025-8110 · GHSA-mq8m-42gh-wq7r · GO-2025-4225 · Published 10/12/2025 · updated 14/10/2026

Gogs Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 12/01/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
gogs.io/gogs Go	`≤ 0.13.3all versions`	No fix yet
gogs gogs	`≤ 0.13.3`	No fix yet

Description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

NVD description

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

References

nvd.nist.gov/vuln/detail/CVE-2025-8110 · ADVISORY
gogs/gogs#8078 · WEB
gogs/gogs#8082 · WEB
gogs/gogs commit 553707f · WEB
GitHub Advisory GHSA-mq8m-42gh-wq7r · ADVISORY
gogs/gogs · PACKAGE
cisa.gov/known-exploited-vulnerabilities-catalog · WEB
wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit · WEB
openwall.com/lists/oss-security/2025/12/11/3 · WEB
openwall.com/lists/oss-security/2025/12/11/4 · WEB
openwall.com/lists/oss-security/2026/01/17/4 · WEB
openwall.com/lists/oss-security/2026/01/18/1 · WEB
openwall.com/lists/oss-security/2026/01/18/2 · WEB
CISA KEV · CVE-2025-8110

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free