CVE-2025-8110 — Gogs Git Server RCE via Symlink Bypass¶

Key facts

CVE-2025-8110 is a Critical (9.1) vulnerability: Gogs Git Server RCE via Symlink Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-01-12), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2025-8110 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-01-12), confirming exploitation in the wild. Federal remediation deadline: 2026-02-02. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2025-8110
Severity	Critical (9.1)
CISA KEV	Actively exploited (added 2026-01-12)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-8110/

Details¶

CVE-2025-8110 is a Critical (9.1) vulnerability: Gogs Git Server RCE via Symlink Bypass. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Overview¶

Attribute	Value
CVE ID	CVE-2025-8110
Severity	Critical
CVSS Score	9.1
Affected Product	Gogs Git Server
Vulnerability Type	Symlink Bypass / File Overwrite / RCE
Exploitation Status	Actively Exploited (Unpatched)

Description¶

CVE-2025-8110 is a symlink bypass vulnerability in Gogs that allows authenticated users to overwrite files outside the repository, leading to Remote Code Execution. This vulnerability is a bypass of a previously patched RCE (CVE-2024-55947).

Affected Versions¶

Gogs all versions (vulnerability remains unpatched in main branch as of December 2025)

Technical Details¶

Root Cause¶

The vulnerability exists in how Gogs handles symlinks during file operations. An authenticated user can create a symbolic link within a repository that points to files outside the repository root, allowing arbitrary file overwrite.

Attack Vector¶

Attacker creates/modifies a repository
Creates symlink pointing to sensitive system file
Pushes content through the symlink
Overwrites target file (e.g., authorized_keys, crontab)
Achieves RCE via overwritten file

Impact¶

Arbitrary file overwrite on server
Remote code execution
Server compromise
Supershell malware deployment observed

Timeline¶

Date	Event
2025-07-10	First exploitation observed
2025-07-15	Supershell malware discovered
2025-11-01	Second wave of attacks
2025-12-10	Still unpatched

Mitigation¶

Migrate to Gitea or other maintained alternatives
Restrict repository creation permissions
Implement file system monitoring
Run Gogs in isolated container with limited permissions

Verification Process¶

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)¶

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing¶

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow¶

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage¶

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References¶

Wiz Research - Gogs Zero-Day

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2025-8110, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2025-8110 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-8110 - Snort IDS Rules
# Severity: High

# Detect potential exploit attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-8110 Potential Exploit Attempt";
    flow:to_server,established;
    content:".."; http_uri;
    classtype:web-application-attack;
    sid:202581101;
    rev:1;
    metadata:cve CVE-2025-8110, severity high;
)

# Detect suspicious patterns in request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-8110 Suspicious Request Pattern";
    flow:to_server,established;
    pcre:"/(%2e%2e|%252e|\x00)/Ui";
    classtype:web-application-attack;
    sid:202581102;
    rev:1;
    metadata:cve CVE-2025-8110, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-8110 - YARA Detection Rules
 */

rule CVE_2025_8110_Exploit {
    meta:
        description = "Detects potential CVE-2025-8110 exploit attempts"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2025-8110"

    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\" ascii wide
        $encoded1 = "%2e%2e" ascii wide nocase
        $encoded2 = "%252e" ascii wide nocase
        $null_byte = "%00" ascii wide

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2025-8110 - Prevention Rules for Nginx

# Block common exploit patterns
location / {
    # Rate limiting
    limit_req zone=general burst=20 nodelay;

    # Block suspicious patterns
    if ($request_uri ~* "(\.\.[\/]|%2e%2e|%252e)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Log suspicious activity
access_log /var/log/nginx/CVE-2025-8110-access.log;
error_log /var/log/nginx/CVE-2025-8110-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2025-8110 - Prevention Rules for Apache httpd

# Block common exploit patterns
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block path traversal
    RewriteCond %{REQUEST_URI} (\.\.[\/]|%2e%2e|%252e) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2025-8110-access.log combined
ErrorLog /var/log/httpd/CVE-2025-8110-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2025-8110?¶

CVE-2025-8110 is a Critical (9.1) vulnerability: Gogs Git Server RCE via Symlink Bypass. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-01-12), confirming active exploitation in the wild.

How do I detect CVE-2025-8110?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2025-8110?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2025-8110 actively exploited?¶

Yes. CVE-2025-8110 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2026-01-12, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2026-02-02. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.