CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC

Proof-of-Concept for CVE-2025-8110, an authenticated arbitrary file write in Gogs ≤ 0.13.3 caused by improper symbolic-link handling in the PutContents API.

An authenticated user can commit a symlink pointing to .git/config, then use the API to overwrite it and inject a malicious sshCommand, resulting in remote code execution.

Disclaimer

For educational and authorized testing only. Do not use against systems you do not own or have explicit permission to test.

Usage

chmod +x poc.sh

./poc.sh \
  -i <target-ip-or-domain> \
  -P <port> \
  -u <username> \
  -p <password> \
  -t <api-token> \
  -c "<command-to-execute>" \
  [-r <repository-name>]   # optional, default: CVE-2025-8110

Example