Path Traversal in Gogs (CVE‑2025‑8110) Enables Remote Code Execution
What It Is – Gogs (“Go Git Service”) suffers a path‑traversal flaw in the PutContents API. Improper handling of symbolic links can be abused to write files outside the intended directory, leading to arbitrary code execution on the host.
Exploitability – The vulnerability is publicly disclosed (CVE‑2025‑8110) and has a CVSS v3.1 base score of 8.8 (High). No public exploit code has been released, but the attack vector is straightforward for an attacker who can reach the API.
Affected Products – Gogs self‑hosted Git service (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous scanning and timely patching of open‑source components used in production.
- Configuration & Change Control – Highlights gaps in how symbolic‑link handling is governed; evidence of proper configuration baselines is a key audit artifact.
- Defensible Audit Trail – Organizations that can show documented remediation (patch applied, configuration validated) meet multiple control objectives across frameworks (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Inventory all Gogs instances and verify version numbers.
- Apply the vendor‑released patch or upgrade to the latest release that fixes CVE‑2025‑8110.
- Review and harden the PutContents API configuration; disable unnecessary write operations.
- Update your vulnerability‑management process to flag symbolic‑link handling as a high‑risk configuration item.
- Capture remediation evidence (patch logs, configuration snapshots) for audit readiness.
Source: CISA KEV – CVE‑2025‑8110