Latest Gogs vulnerability: CVE-2025-8110 #
Security researchers at Wiz have reported a 0-day vulnerability in Gogs. This flaw allows remote, authenticated attackers to overwrite arbitrary files on the vulnerable system. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code on the vulnerable system with the privileges of the Gogs server process.
This vulnerability has been assigned CVE-2025-8110 and has a CVSS score of 7.8.
Note that there is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected
- Gogs versions 0.13.3 and prior
What is Gogs? #
Gogs is a self-hosted Git software forge, allowing users to collaborate on development using Git repositories.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
There is currently no patched fixed version of Gogs available. Users are encouraged to disable auto-registration of users and avoid Internet exposure for any Gogs installations.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:=http AND protocol:=http AND favicon.ico.image.md5:=5f5b7539f014b9996959f5dcd063d383
