Gogs code-execution flaw CVE-2025-8110 used in attacks; fixed in 0.13.4
Attackers exploited Gogs source-code hosting servers through CVE-2025-8110 before a fix existed. Administrators should install 0.13.4 or later and investigate possible compromise. Ordinary family devices need no update for this flaw.
Nothing for you to do on ordinary family phones or computers: this affects Gogs servers. If your business runs Gogs, ask its administrator to install 0.13.4 or later, restrict access and check for signs of compromise; disable open registration while an update is pending.
What’s happening
CVE-2025-8110 affects Gogs, software organisations run to host source-code repositories. Incorrect handling of symbolic links, which point to other files, lets a signed-in attacker overwrite files outside a repository and run code on the server. Open registration increases exposure because attackers can create their own accounts. Versions through 0.13.3 are affected. Wiz observed exploitation from July 2025 and reported more than 700 compromised servers when it disclosed the flaw in December. CISA added it to its exploited-vulnerabilities catalogue on 12 January 2026. Code patches preceded the stable fix, released in Gogs 0.13.4 on 23 January. GitHub's database still lists no patched version, but that entry was last updated on 20 January, before the release. As at 3 November, the reviewed sources provide no confirmation that attacks have ended or that previously compromised servers have been cleaned.
- What
- Flaw
- Affects
- Gogs self-hosted source-code hosting server
- Affected
- Gogs versions through 0.13.3
- Fixed in
- Gogs 0.13.4
- Since
- 12 Jan 2026
- Closed
- 23 Jan 2026
Timeline
- New fixFixed
Gogs released stable version 0.13.4, including the fix for code execution through its repository file-update API.
- CISA addedPartly fixed
CISA added CVE-2025-8110 to its exploited-vulnerabilities catalogue, setting a 2 February deadline for US federal civilian agencies. BleepingComputer reported code patches were available; the stable fixed release followed later.
- Made publicNo fix yet
Wiz publicly disclosed CVE-2025-8110, reporting more than 700 compromised Gogs servers. No fix was available at disclosure.
- Wider attacks
Wiz observed a second wave of attacks.
- Update
Gogs maintainers acknowledged Wiz's report.
- Update
Wiz privately reported the vulnerability to Gogs maintainers.
- UpdateNo fix yet
Wiz first observed evidence of attacks exploiting the Gogs flaw, months before public disclosure.
Sources
- Gogs 0.13.4 release notesGogs · 23 Jan 2026
- Gogs 0-Day Exploited in the WildWiz · 10 Dec 2025
- CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacksBleepingComputer · 12 Jan 2026
- CVE-2025-8110: Gogs vulnerable to a bypass of CVE-2024-55947GitHub Advisory Database · 20 Jan 2026