Gogs Zero-Day (CVE-2025-8110) Risks RCE for 700+ Servers via Symlink Path Traversal Bypass

Security researchers have uncovered a zero-day in Gogs (CVE-2025-8110) that allows attackers to bypass patches and execute arbitrary code on the server, with active exploitation reported as of 1 December 2025 and no official patch released.

According to Wiz Threat Research team, the flaw enables a bypass of a prior path traversal fix by not properly accounting for symbolic links, allowing an attacker with repository creation permissions to commit a symlink to a sensitive system file and write data to it via the API.

The attacks have been characterised as a “smash-and-grab” campaign, deploying a payload built with the Supershell framework to establish a reverse SSH shell for full remote control, and the malware is heavily obfuscated with garble and UPX packing to hinder analysis. Of roughly 1,400 exposed Gogs instances scanned by Wiz, over 700 showed signs of compromise, meaning more than half of the exposed servers observed were affected.

Investigators note that infected repositories typically feature random 8-character names created around 10 July, indicating a distinct automated pattern rather than stealthy espionage. Administrators are urged to disable Open Registration, isolate the service behind a VPN or allow-list, and hunt for indicators such as the July 10th‑dated random-named repositories.