CVE record

CVE-2025-8110

Gogs Path Traversal Vulnerability

Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.

Known exploitation

Listed in CISA KEV

Absence from the fetched catalog does not establish that exploitation has not occurred.

Severity

high

CVSS 8.8 · CVSS_V3

Affected packages

Supported package records returned by OSV. Vendor and product names are not used to infer matches.

CISA Known Exploited Vulnerabilities

Catalog record

Vendor / project: Gogs
Product: Gogs
Date added: Jan 12, 2026
CISA federal remediation due date: Feb 2, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware campaign use: Unknown
CWE: CWE-22

OSV package mapping

Package	Ecosystem	Fixed versions
gogs.io/gogs	go	Not specified