CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity flaw in Gogs, tracked as CVE-2025-8110 with a CVSS score of 8.7, which relates to a path traversal issue in the repository file editor that could enable code execution. According to CISA, attackers bypass protections by manipulating the PutContents API to write data to a symbolic link, potentially overwriting target files such as Git configuration settings and gaining code execution privileges.

Wiz said it identified 700 compromised Gogs instances, and data from Censys shows about 1,600 internet-exposed Gogs servers, with the majority in China, followed by the U.S., Germany, Hong Kong and Russia. There are currently no patches addressing CVE-2025-8110, although GitHub pull requests suggest the necessary code changes have been made and may be included once builds reach main.

In the meantime, users are advised to disable the default open-registration setting and limit server access via VPN or an allow-list, with Federal Civilian Executive Branch agencies required to apply mitigations by 2 February 2026.