CVE-2025-8110: Code execution in Gogs through symlink handling

CVE-2025-8110 is a vulnerability affecting improper symbolic link handling in the PutContents API of Gogs, a widely-deployed self-hosted git hosting platform used in enterprise infrastructures. The flaw allows authenticated attackers to execute arbitrary code locally on the target system, posing a critical risk for organizations exposing Gogs on networks or in multi-tenant environments.

The vulnerability is assigned a CVSS score of 8.8 (high). A public proof of concept appeared on GitHub on November 2, 2026, the same day as this report, indicating that exploit code is already documented and available for study in the security community. The vulnerability was published by NIST on December 10, 2025. While a public PoC exists, no confirmed in-the-wild attacks have been reported in public databases.

Administrators of Gogs instances must immediately verify the installed version and PutContents API configuration, consulting the official project changelog for patch guidance. It is essential to restrict authenticated access to Gogs through firewalls, network segmentation, and MFA; audit access logs and file modification logs in prior days to detect any potential exploitation. Monitor repositories for unauthorized changes and verify content integrity.

Improper symlink handling is a classic attack vector in file hosting and repository systems. Within the context of Gogs' PutContents API, an authenticated attacker could exploit this weakness to write files to unintended locations on the file system, bypassing access controls and gaining control of the application or underlying server.