8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8110

CVE-2025-8110: File overwrite in file update API in Gogs

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8110

CVE-2025-8110:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability started with the information from the Wiz research blog post, which clearly described the vulnerability as a symbolic link bypass of a previous path traversal fix (CVE-2024-55947) in the PutContents API. The blog post detailed the attack chain, which involves creating a symbolic link in a repository and then using the PutContents API to write to it, causing an arbitrary file write. Based on this, I identified PutContents as the main vulnerable function. I then located the source code for this function in the gogs/gogs repository at internal/route/api/v1/repo/contents.go. The code confirms that the path is taken from the user-provided URL (c.Params("*")), and although it is cleaned using pathutil.Clean, there is no check to prevent the path from being a symbolic link. The cleaned path is then used in the UpdateRepoFile function, which performs the file write operation. This confirms that gogs.io/gogs/internal/route/api/v1/repo.PutContents is the vulnerable function that would be seen in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.