U.S. CISA adds a flaw in Gogs to its Known Exploited Vulnerabilities catalog

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a Gogs path traversal vulnerability has been added to the Known Exploited Vulnerabilities catalog, tracked as CVE-2025-8110 with a CVSS score of 8.7. The flaw arises from improper symbolic link handling in the PutContents API, allowing authenticated users to overwrite files outside the repository and achieve remote code execution.

Wiz Research reported that a symlink bypass of a previously patched RCE (CVE-2024-55947) enables this overwrite, with researchers identifying over 700 compromised Gogs instances publicly facing on the internet and around 1,400 exposed Gogs instances showing the same patterns. The new bypass takes advantage of Git’s symlink feature, and attackers can create a symlink in a repository that points outside the repo, using the API to write through the link and overwrite targets such as the .git/config.

Agencies are mandated to address these vulnerabilities by 2 February 2026 under Binding Operational Directive 22-01, while private organisations are advised to review the KEV catalog and address the flaws in their infrastructure.