Unpatched Gogs Zero-Day Exploited for Months

More than 700 Gogs instances have been compromised via an unpatched zero-day vulnerability in the self-hosted Git service, according to SecurityWeek. The flaw, tracked as CVE-2025-8110, allows authenticated attackers to overwrite files outside the repository and achieve remote code execution via the PutContents API, Wiz explains, after the bug was identified in July.

The issue is a symlink bypass of CVE-2024-55947, a path traversal flaw in the Gogs file update API, and patches were released in December 2024 for version 0.13.1; nevertheless, attackers have exploited the vector for months because the fix did not account for symbolic links.

Wiz notes there are over 1,400 exposed Gogs instances, with more than 700 infected to date, and all infected instances shared a pattern of eight-character owner/repo names created in a short window on July 10th, suggesting a single actor or closely linked group. All Gogs servers running version 0.13.3 or older are vulnerable if internet-exposed with open-registration enabled, and as of 10 December no patch was available.