CVE-2025-8110
Gogs Path Traversal Vulnerability
Published Dec 10, 2025 · updated Jun 17, 2026 · Gogs Gogs
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · Catalog
Detected
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Jan 12, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Feb 2, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Feb 2, 2026
Affected
- cpe gogs/gogsversion unspecified
- vendor Gogs Gogsversion unspecified
Sources
- CISA KEVCVE-2025-8110
Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
cisa.gov - CVE.orgCVE-2025-8110
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-8110
30-day exploitation probability 85.2%
first.org - NIST NVDCVE-2025-8110
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
nvd.nist.gov