Quick Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies address a critical Gogs vulnerability, tracked as CVE-2025-8110, which has been exploited in zero-day attacks. This remote code execution flaw allows authenticated attackers to overwrite files outside the repository, posing significant risks to affected systems. CISA has ordered agencies to implement patches by February 2, 2026, following reports of over 1,400 exposed Gogs servers, with more than 700 showing signs of compromise.
The Securityish Brief
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a high-severity vulnerability in Gogs, a Git service alternative, tracked as CVE-2025-8110. This remote code execution (RCE) flaw arises from a path traversal issue in the PutContents API, enabling authenticated attackers to bypass previous protections and overwrite sensitive files outside the repository. The vulnerability was discovered by Wiz Research during an investigation of a malware infection affecting a customer’s Gogs server in July 2025.
Wiz reported the flaw to Gogs maintainers on July 17, 2025, who acknowledged the report on October 30, 2025. Patches for CVE-2025-8110 were released shortly after, on January 5, 2026, which included symlink-aware path validation at all file-write entry points. Despite these efforts, a second wave of attacks exploiting this zero-day vulnerability was observed on November 1, 2025.
Wiz Research found over 1,400 Gogs servers exposed online, with 1,250 still vulnerable as of the report. Of these, more than 700 instances showed signs of compromise. CISA has confirmed the vulnerability’s exploitation in the wild and has added it to its list of known exploited vulnerabilities, mandating that Federal Civilian Executive Branch (FCEB) agencies apply patches by February 2, 2026.
Understanding the Risks
This vulnerability poses significant risks to federal agencies and other organizations using Gogs, as it can allow attackers to execute arbitrary commands on compromised systems. CISA has emphasized the need for agencies to apply mitigations as per vendor instructions, follow applicable guidance for cloud services, or discontinue use if patches are unavailable.
To further mitigate risks, Gogs users should disable the default open-registration setting and restrict server access through a VPN or an allow list. Additionally, administrators should monitor for suspicious activity related to the PutContents API and check for repositories with random eight-character names created during the attack waves.
Key Takeaways
- Patch Gogs instances by February 2, 2026, to address CVE-2025-8110 as mandated by CISA.
- Disable the default open-registration setting on Gogs to reduce exposure to unauthorized access.
- Limit server access using a VPN or an allow list to enhance security.
- Monitor Gogs instances for suspicious use of the PutContents API to detect potential compromises.
- Check for repositories with random eight-character names created during the attack waves to identify signs of exploitation.
Key Terms & Concepts
- CVE-2025-8110: In this article, CVE-2025-8110 refers to a critical remote code execution vulnerability in Gogs that allows attackers to overwrite files outside the repository.
- Gogs: Gogs is a self-hosted Git service designed as an alternative to GitLab or GitHub Enterprise, often used for remote collaboration.
- RCE: Remote Code Execution (RCE) is a type of vulnerability that allows an attacker to execute arbitrary code on a remote system.
- Path Traversal: Path traversal is a security vulnerability that allows attackers to access files and directories stored outside the intended directory.
Read the original article here: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
