Gogs Path Traversal in PutContents API (CVE-2025-8110)

Historical catalog analysis: CISA added this entry on January 12, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-8110 is a path traversal vulnerability (CWE-22) identified in Gogs. The flaw stems from improper handling of symbolic links within the PutContents API. If exploited, this vulnerability could allow an attacker to traverse directories and potentially achieve code execution on the host system.

Exposure and applicability

This vulnerability applies to Gogs instances utilizing the PutContents API. Organizations running self-hosted Gogs environments should identify if their current deployment is susceptible based on the vendor’s commit history. Because this vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, it is categorized as a high-priority exposure for infrastructure owners.

Remediation priorities

Based on our analysis, remediation should be prioritized according to the following hierarchy:

1. Apply Vendor Fixes: The primary corrective action is to apply the mitigations provided by the vendor. Specifically, reference commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6 to ensure the symbolic link handling in the PutContents API is corrected.
2. API Access Restriction: Until patching is verified, restricting access to the affected API may reduce the immediate attack surface.
3. Decommissioning: If mitigations cannot be applied or verified, our analysis suggests discontinuing use of the product to eliminate the risk.

How to validate remediation

Verification must go beyond a simple version check. To ensure exposure is reduced, defenders should consider the following:

• Commit Verification: Confirm that the specific code changes introduced in commit 553707f3fd5f68f47f531cfcff56aa3ec294c6f6 are present in the deployed binary or source.
• Functional Testing: In a staged environment, verify that the PutContents API no longer permits the creation or utilization of symbolic links to access files outside of the intended directory scope.

Limits and open questions

A critical residual risk is that applying a patch may not remove malicious symbolic links already present on the filesystem if an attacker had prior access. Patching prevents new exploitations but does not inherently sanitize existing filesystem state. Additionally, while CISA has flagged this as known to be exploited, the specific nature of these exploits and whether they are linked to ransomware campaigns remains unknown.

Source and editorial note

CVE-2025-8110: Gogs Path Traversal Vulnerability · Source date: January 12, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 15, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 24, 2026 at 00:17 UTC.

Request a Vulnerability Assessment