Gogs CVE-2025-8110

Requires an authenticated account with write/push access to at least one repository (consistent with PR:L); the attacker then abuses the Gogs file-editor 'PutContents' API path, where the pre-patch UpdateRepoFile/GetDiffPreview logic only checked the final target for being a symlink and failed to reject symlinks anywhere in the path hierarchy, allowing a planted symlink to redirect the os.WriteFile write outside the repository working directory and achieve code execution. Limiting factors: exploitation is gated on obtaining repository write permission (not fully anonymous), and no victim user interaction is needed (UI:N). The fix (commit 553707f3) rejects any operation where hasSymlinkInPath detects a symlink in the path, so patched instances are not exploitable via this vector.

This is a genuine top-priority vulnerability, with multiple independent signals aligning rather than conflicting. CISA KEV confirms active exploitation in the wild, EPSS is 85.20% at the 100th percentile (among the most likely-to-be-exploited CVEs tracked), and a public exploit exists (Wiz Research RCE write-up plus the upstream PR). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) with SSVC-style metrics E:A (attacked) and V:C (concentrated/confirmed) reinforces that this is weaponized, not theoretical. The one notable tension is that the NVD description labels this 'Local Execution of Code' while the CVSS vector is AV:N (network): the realistic reading is that a remote, network-reachable but authenticated user (PR:L - needs a valid account with repository write access) abuses the server-side file-editor API to achieve code execution ON the server host; the 'local' wording likely refers to the server-side code-execution outcome rather than requiring local/console access. Net: not a high-CVSS-but-low-real-risk issue - treat as emergency patching given KEV + public exploit + near-certain EPSS.

An attacker who holds (or registers/obtains) an account with write access to a Gogs repository uses the file-editor 'PutContents' API to create or update a file along a path that passes through an attacker-planted symbolic link, causing Gogs to write attacker-controlled content to a location outside the intended repository directory and leading to code execution on the server. A public proof-of-concept and technical exploit write-up exist (Wiz Research), and CISA KEV confirms this chain is being used in the wild. The low attack complexity (AC:L) and lack of required user interaction make exploitation straightforward once write access is held.