Gogs <= 0.13.3 - Remote Code Execution

id: CVE-2025-8110

info:
  name: Gogs <= 0.13.3 - Remote Code Execution
  author: rxerium
  severity: high
  description: |
    Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a symlink pointing to sensitive targets, leading to remote code execution. As of December 2025, this remains an unpatched zero-day with active exploitation ongoing. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise. The vulnerability stems from the API writing to file paths without checking if targets are symlinks pointing outside the repository. Gogs maintainers are working on a fix.
  remediation: |
    Update to the latest version of Gogs.
  impact: |
    Local attackers can execute arbitrary code, potentially leading to full system compromise.
  reference:
    - https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
    - https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html
    - https://github.com/advisories/ghsa-mq8m-42gh-wq7r
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8110
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-8110
    epss-score: 0.7654
    epss-percentile: 0.99482
    cwe-id: CWE-22
  metadata:
    verified: true
    vendor: gogs
    product: gogs
    max-request: 1
    shodan-query: http.title:"Sign In - Gogs"
  tags: cve,cve2025,gogs,git,symlink,rce,kev,vkev,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/user/login"

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - 'Gogs Version: ([0-9.]+)'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Sign In - Gogs: Go Git Service")'
          - 'compare_versions(version, "<= 0.13.3")'
        condition: and
# digest: 490a0046304402206c6f26e538b36f33e89aa96040884dfc4f0652e32a718ae13b01d4a733ac775a02202fffd3967858640ca3c587f60f20e85f5d8c98ea4edf521f064611075b801e5a:922c64590222798bb761d5b6d8e72950