CVE-2025-8110-PoC

CVE-2025-8110 概念验证 Python 概念验证脚本，针对 CVE-2025-8110 — Gogs v0.13.3 UpdateRepoFile 符号链接远程代码执行。单次攻击：恶意 PUT 请求本身触发 git fetch → sshCommand → 反弹 shell。 ⚠️ 仅供教育和授权安全研究使用。 针对你不拥有或未经书面许可测试的系统运行此工具是非法的。 详情 针对 CVE-2025-8110 的 PoC 受影响版本：Gogs v0.13.3 已修复版本：Gogs v0.13.4...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the UpdateRepoFile function. An attacker can execute arbitrary system commands by updating files within the .git directory remotely via API router. This vulnerability is a bypass for the one addressed in...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the UpdateRepoFile function. An attacker can execute arbitrary system commands by updating files within the .git directory remotely via API router. This vulnerability is a bypass for the one addressed in...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the UpdateRepoFile function. An attacker can execute arbitrary system commands by updating files within the .git directory remotely via API router. This vulnerability is a bypass for the one addressed in...

OS Command Injection

github.com/gogs/gogs is vulnerable to OS command injection. The vulnerability exists only in windows when the repository upload is enabled, allowing an attacker to upload maliciously crafted config file to the UpdateRepoFile function of repoeditor.go and gain SSH access to the server...