{"id":"gogs-path-traversal-attacks-jan-2026","category":"patch","status":"closed","title":"Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4","tldr":"Attackers exploited Gogs source-code hosting servers through CVE-2025-8110 before a fix existed. Administrators should install 0.13.4 or later and investigate possible compromise. Ordinary family devices need no update for this flaw.","summary":"CVE-2025-8110 affects Gogs, software organisations run to host source-code repositories. Incorrect handling of symbolic links, which point to other files, lets a signed-in attacker overwrite files outside a repository and run code on the server. Open registration increases exposure because attackers can create their own accounts. Versions through 0.13.3 are affected. Wiz observed exploitation from July 2025 and reported more than 700 compromised servers when it disclosed the flaw in December. CISA added it to its exploited-vulnerabilities catalogue on 12 January 2026. Code patches preceded the stable fix, released in Gogs 0.13.4 on 23 January. GitHub's database still lists no patched version, but that entry was last updated on 20 January, before the release. As at 3 November, the reviewed sources provide no confirmation that attacks have ended or that previously compromised servers have been cleaned.","action":"Nothing for you to do on ordinary family phones or computers: this affects Gogs servers. If your business runs Gogs, ask its administrator to install 0.13.4 or later, restrict access and check for signs of compromise; disable open registration while an update is pending.","product":"Gogs self-hosted source-code hosting server","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-8110"],"tags":["gogs","git","server","path-traversal","zero-day"],"affected":["Gogs versions through 0.13.3"],"fixed":["Gogs 0.13.4"],"matches":[],"sources":[{"kind":"advisory","title":"Gogs 0.13.4 release notes","url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","by":"Gogs","date":"2026-01-23"},{"kind":"research","title":"Gogs 0-Day Exploited in the Wild","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","date":"2025-12-10"},{"kind":"news","title":"CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/","by":"BleepingComputer","date":"2026-01-12"},{"kind":"advisory","title":"CVE-2025-8110: Gogs vulnerable to a bypass of CVE-2024-55947","url":"https://github.com/advisories/GHSA-mq8m-42gh-wq7r","by":"GitHub Advisory Database","date":"2026-01-20"}],"started":"2026-01-12","closed":"2026-01-23","created":"2026-11-03T22:35:28.357Z","updated":"2026-11-03T22:35:28.357Z","cve_notes":[{"cve":"CVE-2025-8110","name":"Symbolic-link path traversal in Gogs PutContents API","what":"Incorrect symbolic-link handling in Gogs' repository file-update API lets a signed-in attacker overwrite files outside a repository and run code on the server.","severity":"high","cvss":8.7}],"timeline":[{"at":"2026-01-23","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Gogs released stable version 0.13.4, including the fix for code execution through its repository file-update API.","url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","by":"Gogs","patch":"patched"},{"at":"2026-01-12","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-8110 to its exploited-vulnerabilities catalogue, setting a 2 February deadline for US federal civilian agencies. BleepingComputer reported code patches were available; the stable fixed release followed later.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/","by":"BleepingComputer","patch":"partial"},{"at":"2025-12-10","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Wiz publicly disclosed CVE-2025-8110, reporting more than 700 compromised Gogs servers. No fix was available at disclosure.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":"none"},{"at":"2025-11-01","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Wiz observed a second wave of attacks.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null},{"at":"2025-10-30","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Gogs maintainers acknowledged Wiz's report.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null},{"at":"2025-07-17","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Wiz privately reported the vulnerability to Gogs maintainers.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":null},{"at":"2025-07-10","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Wiz first observed evidence of attacks exploiting the Gogs flaw, months before public disclosure.","url":"https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","by":"Wiz","patch":"none"}],"url":"https://hard.fyi/live/gogs-path-traversal-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=gogs-path-traversal-attacks-jan-2026"}