Attackers Exploited Gogs Zero-Day Flaw for Months

A vulnerability in the self-hosted Git service Gogs is being actively exploited with no patch available, according to Wiz. Wiz disclosed CVE-2025-8110 on 10 December, describing it as a bypass for the remote code execution flaw CVE-2024-55947 that was disclosed last year. The new flaw allows threat actors to execute code by abusing symbolic links and a PutContents API path that does not validate the destination of a symlink, enabling writes outside the repository.

Wiz says it first detected exploitation on 10 July, and reports that 1,400 exposed instances and more than 700 compromised ones were found via Shodan, suggesting a likely lone threat actor behind a smash-and-grab campaign. Vulnerable installations are those at or under version 0.13.3 with open registration enabled, and Wiz recommends disabling open registration, limiting internet exposure, and looking for signs such as repositories with random eight-character names or PutContents API usage.