{"id":"EUVD-2025-202425","enisaUuid":"dacebb29-4aa5-3cff-b3f4-751119f3e6fc","description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","datePublished":"Dec 10, 2025, 1:23:46 PM","dateUpdated":"Feb 26, 2026, 4:21:06 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C","references":"http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit\n","aliases":"CVE-2025-8110\nGHSA-mq8m-42gh-wq7r\n","assigner":"Wiz","epss":85.2,"exploitedSince":"Jan 12, 2026, 12:00:00 AM","enisaIdProduct":[{"id":"cc623298-cccd-3612-a3c3-b36027893e4b","product":{"name":"gogs","vendor":{"name":"gogs"}},"product_version":"0 ≤0.13.3"}],"enisaIdVendor":[{"id":"8e5b1605-3b04-37af-a28e-608b137f9899","vendor":{"name":"gogs"}}],"enisaIdVulnerability":[{"id":"44a1f4b1-bcdf-3160-9334-c103931d889b","vulnerability":{"id":"GHSA-mq8m-42gh-wq7r","description":"Gogs vulnerable to a bypass of CVE-2024-55947","datePublished":"Dec 10, 2025, 3:31:24 PM","dateUpdated":"Jan 20, 2026, 8:48:49 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-8110\nhttps://github.com/gogs/gogs/pull/8078\nhttps://github.com/gogs/gogs/pull/8082\nhttps://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6\nhttps://github.com/advisories/GHSA-mq8m-42gh-wq7r\nhttps://github.com/gogs/gogs\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve\u003dCVE-2025-8110\nhttp://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit\nhttp://www.openwall.com/lists/oss-security/2025/12/11/3\nhttp://www.openwall.com/lists/oss-security/2025/12/11/4\nhttp://www.openwall.com/lists/oss-security/2026/01/17/4\nhttp://www.openwall.com/lists/oss-security/2026/01/18/1\nhttp://www.openwall.com/lists/oss-security/2026/01/18/2\n","enisa_id":"EUVD-2025-202425\n","aliases":"GHSA-mq8m-42gh-wq7r\nCVE-2025-8110\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"db0ea6d8-7372-3271-a050-98994475987b","vulnerability":{"id":"CVE-2025-8110","description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","datePublished":"Dec 10, 2025, 1:23:46 PM","dateUpdated":"Feb 26, 2026, 4:21:06 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C","references":"http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit\n","enisa_id":"EUVD-2025-202425\n","assigner":"Wiz","epss":85.2,"dataProcessed":"Nov 8, 2026, 7:15:24 AM","exploitedSince":"Jan 12, 2026, 12:00:00 AM","vulnerabilityProduct":[{"id":"c70bc8e7-f482-3ca6-9ae3-7c187ab58d23","product":{"name":"gogs","vendor":{"name":"gogs"}},"product_version":"0 ≤0.13.3"}],"vulnerabilityVendor":[{"id":"fd770b0b-bbeb-32ea-9567-62114a6304c4","vendor":{"name":"gogs"}}]}}],"enisaIdAdvisory":[]}