Loading CVE intelligence

CVE-2025-8110

HighPublished

File overwrite in file update API in Gogs

Published: Dec 10, 2025
Updated: Feb 26, 2026
Assigning CNA: Wiz
Evidence observed: Jan 12, 2026

Primary CVSS

8.7/ 10High

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X

EPSS probability estimate

82.5%

High · next 30 days

Percentile: 99.7%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

Sources

21

CVE-2025-8110Exploit
RCE exploit for Gogs <= 0.13.3
CVE-2025-8110Exploit
CVE-2025-8110 — Gogs <= 0.13.3 Arbitrary File Write via Symlink Traversal in PutContents API
CVE-2025-8110-Gogs-RCE-ExploitExploit
Gogs CVE-2025-8110 RCE Exploit
CVE-2025-8110Exploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Proof-of-concept exploit for CVE-2025-8110, a Gogs RCE vulnerability exploiting path traversal via symbolic links and sshCommand injection to deliver a reverse shell.

CVE-2025-8110Exploit

Gogs service Exploit and get the root user

CVE-2025-8110Exploit

PoC exploit for CVE-2025-8110

CVE-2025-8110-PoCExploit

One-shot exploit for Gogs symlink RCE (CVE-2025-8110) that triggers a reverse shell via a single PUT request to UpdateRepoFile.

CVE-2025-8110Exploit

Gogs Symlink Traversal → RCE

CVE-2025-8110Detection

Detection template for CVE-2025-8110

CVE-2025-8110-gogs-pocPoC

PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink

CVE-2025-8110Exploit

Gogs RCE PoC - CVE-2025-8110

gogs-CVE-2025-8110Exploit

CVE-2025-8110 PoC

CVE-2025-8110PoC

Proof-of-concept exploit for CVE-2025-8110 in Gogs <=0.13.x, enabling authenticated symlink bypass to arbitrary file write as the Gogs process user, leading to local privilege escalation.

cve-2025-8110-GOGS-RCEExploit

GOGS RCE cve-2025-8110 python script that automates the whole attack chain of creating a repository with a symlink file pointing to .git/config and then triggering rce via a poisoned sshCommand on the config file.

goga-cve-2025-8110Scanner

验证 Gogs 版本 0.13.2 是否存在 **CVE-2025-8110 (符号链接文件覆盖)** 漏洞。

CVE-2025-8110PoC

PoC for CVE-2025-8110: Authenticated RCE in Gogs via symlink bypass in PutContents API

CVE-2025-8110-Gogs-Remote-Code-ExecutionPoC

Proof-of-concept exploit for CVE-2025-8110, a command injection vulnerability in Gogs Git hook mechanism enabling remote code execution on self-hosted Git servers.

CVE-2025-8110-Silentium-HTBExploit

CVE-2025-8110 Specifically for the Silentium box on HTB.

HTB-Silentium-WriteupResearch

Hack The Box - Silentium machine writeup | CVE-2025-58434, CVE-2025-59528, CVE-2025-8110

CVE-2025-8110PoC

Python proof-of-concept for CVE-2025-8110, demonstrating arbitrary file write to RCE in Gogs via symlink and API, with educational lab usage.

1day-archiveResearch

Technical deep-dives and root cause analyses of recently disclosed CVEs - reverse engineering patches, building proof-of-concepts, and documenting exploitation techniques in the 1-day window.