Path traversal in gogs - CVE-2025-8110
Published: December 11, 2025 / Updated: June 23, 2026
Vulnerability identifier: #VU119869
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-8110
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to improper symbolic link handling in the PutContents API caused by insufficient patch for #VU119868 (CVE-2024-55947). A remote user can write file to arbitrary location on the system and execute arbitrary code.
Note, the vulnerability is being actively exploited in the wild.
Affected software
gogs
How to mitigate CVE-2025-8110
Install update from vendor's website.
gogs - update to 0.13.4