{"id":"GHSA-mq8m-42gh-wq7r","revision":"61e9e507d3e84babb484baba07f44113","records":[{"revision":"61e9e507d3e84babb484baba07f44113","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mq8m-42gh-wq7r","aliases":["CVE-2025-8110","GO-2025-4225"],"title":"Gogs vulnerable to a bypass of CVE-2024-55947","description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","state":0,"publishedAt":"2025-12-10T15:31:24+00:00","modifiedAt":"2026-02-03T02:58:31.328659+00:00","affected":[{"ecosystem":"Go","name":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.13.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-8110","https://github.com/gogs/gogs/pull/8078","https://github.com/gogs/gogs/pull/8082","https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6","https://github.com/advisories/GHSA-mq8m-42gh-wq7r","https://github.com/gogs/gogs","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110","http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","http://www.openwall.com/lists/oss-security/2025/12/11/3","http://www.openwall.com/lists/oss-security/2025/12/11/4","http://www.openwall.com/lists/oss-security/2026/01/17/4","http://www.openwall.com/lists/oss-security/2026/01/18/1","http://www.openwall.com/lists/oss-security/2026/01/18/2"],"sourceUrl":"https://github.com/advisories/GHSA-mq8m-42gh-wq7r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mq8m-42gh-wq7r","identifiers":["GHSA-mq8m-42gh-wq7r","CVE-2025-8110","GO-2025-4225"]},"retained":false,"historicalAffected":[]}],"coverage":[]}