CISA “Must-Patch” Alert: Critical Gogs Exploit CVE-2025-8110 Active in Wild

According to CISA, a dangerous new entry has been added to its “Must-Patch” list warning that a popular self-hosted Git service called Gogs is being actively exploited to breach networks via CVE-2025-8110. The vulnerability, which scores a high-severity CVSS of 8.7, bypasses a prior fix for an earlier remote code execution bug (CVE-2024-55947) and relies on a symlink bypass that allows an authenticated user to apply path traversal to overwrite files outside the repository directory.

In practical terms, this can enable a rogue user or an attacker who has compromised a low-level developer account to escape the application's sandbox and execute arbitrary code on the underlying server. It was first identified as an active zero-day on 10 July 2025 by Wiz Research, with ongoing evidence of exploitation since then prompting the intervention.

Federal Civilian Executive Branch agencies have been given a strict deadline of 2 February 2026 to secure their servers or disconnect them, and organisations running Gogs are urged to update promptly and restrict deployments from the open internet where possible.