CISA Alerts on Active Exploitation of Gogs Vulnerability CVE-2025-8110
- Securityish
- Threats & Incidents
Quick Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of a high-severity vulnerability in Gogs, tracked as CVE-2025-8110, with a CVSS score of 8.7. This vulnerability allows for code execution through a path traversal issue in the repository file editor. Currently, there are approximately 1,600 internet-exposed Gogs servers, with 700 instances already compromised, highlighting the urgency for users to take protective measures.
The Securityish Brief
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Gogs, a self-hosted Git service, to its Known Exploited Vulnerabilities catalog. This vulnerability, identified as CVE-2025-8110, has a CVSS score of 8.7 and is related to a path traversal issue that could lead to code execution. The flaw was discovered by Wiz, which reported that it was being actively exploited in zero-day attacks.
Specifically, the vulnerability allows attackers to bypass existing protections from CVE-2024-55947 by creating a git repository and committing a symbolic link to a sensitive target. This process enables the underlying operating system to overwrite critical files outside the repository, potentially granting attackers code execution privileges.
As of now, Wiz has identified 700 compromised Gogs instances among the approximately 1,600 Gogs servers exposed to the internet. The majority of these servers are located in China (991), the U.S. (146), Germany (98), Hong Kong (56), and Russia (49). This widespread exposure raises significant concerns for organizations using Gogs.
Currently, there are no patches available for CVE-2025-8110, although code changes have been proposed on GitHub. Users are advised to disable the default open-registration setting and restrict server access through a VPN or allow-list. Federal Civilian Executive Branch (FCEB) agencies must implement necessary mitigations by February 2, 2026.
Understanding the Risks
This situation underscores the importance of promptly addressing vulnerabilities in software systems. Organizations using Gogs should be particularly vigilant, as the exploitation of this vulnerability could lead to unauthorized access and manipulation of sensitive data.
Users should regularly monitor their systems for unusual activity and ensure that their configurations are secure. Limiting access to trusted users and employing VPNs can significantly mitigate risks associated with such vulnerabilities.
Key Takeaways
- Disable the default open-registration setting in Gogs to prevent unauthorized access.
- Limit server access by using a VPN or implementing an allow-list.
- Regularly monitor Gogs instances for any signs of unusual activity.
- Stay updated on patches and security advisories related to Gogs.
- Ensure that sensitive files and configurations are protected from unauthorized changes.
Key Terms & Concepts
- CVE-2025-8110: In this article, CVE-2025-8110 refers to a high-severity vulnerability in Gogs that allows for code execution through path traversal.
- Path Traversal: Path traversal is a type of security vulnerability that allows attackers to access files and directories outside the intended directory.
- CISA: CISA stands for the Cybersecurity and Infrastructure Security Agency, a U.S. government agency that protects the nation’s critical infrastructure.
- CVSS: CVSS, or Common Vulnerability Scoring System, is a standardized method for rating the severity of security vulnerabilities.
Read the original article here: https://thehackernews.com/2026/01/cisa-warns-of-active-exploitation-of.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
