Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks

A high-severity unpatched vulnerability in Gogs is under active exploitation, with more than 700 compromised instances exposed on the internet and around 1,400 exposed in total, according to Wiz’s findings. The flaw, tracked as CVE-2025-8110, has a CVSS score of 8.7 and involves a file-overwrite issue in the file update API of the Go-based self-hosted Git service.

Wiz says the attack bypasses a previously patched remote code execution flaw (CVE-2024-55947) and notes that the exploit leverages the PutContents API and symlinks to enable arbitrary code execution. The description of the vulnerability states that “Improper symbolic link handling in the PutContents API in Gogs allows local execution of code,” according to CVE[.]org.

The researchers observed that the employed malware payload appears to be based on Supershell, and that attackers left behind repositories on the customer’s cloud workload rather than deleting them, suggesting a smash-and-grab campaign. Wiz also warns that the issue remains unfixed, and recommends disabling open registration, limiting internet exposure, and scanning for repositories with random eight-character names.