CISA Orders Federal Agencies to Address Gogs Vulnerability CVE-2025-8110
- Securityish
- Threats & Incidents
Quick Summary
CISA has mandated that federal agencies stop using Gogs or secure it immediately due to a high-severity vulnerability, CVE-2025-8110, which allows remote code execution. Discovered by Wiz researchers, this flaw has already compromised over 700 Gogs instances. The vulnerability is being actively exploited, prompting urgent remediation actions for federal civilian executive branch agencies.
The Securityish Brief
CISA has added a critical vulnerability, tracked as CVE-2025-8110, to its Known Exploited Vulnerabilities catalog, affecting the self-hosted Git service Gogs. This vulnerability, identified by Wiz security researchers in December, allows authenticated users to bypass protections and overwrite arbitrary files, leading to remote code execution. At the time of disclosure, more than 700 Gogs instances were confirmed compromised, with over 1,400 servers reachable online.
The vulnerability was discovered during an investigation into malware on an infected machine, revealing that it was unpatched since its initial identification in July. CISA’s advisory indicates that the flaw is being weaponized in attacks, urging federal agencies to apply mitigations or cease using Gogs if no workarounds are available.
Wiz noted that the vulnerability is a bypass of a previous fix, which failed to account for symbolic links, a feature that allows Gogs to point to other files or directories. This oversight has made the vulnerability easy to exploit, especially with default settings enabled.
While no specific threat actor has been identified, Wiz researchers suspect that the attackers may be located in Asia, based on the use of Supershell C2. For organizations and users running Gogs outside the federal sector, the situation remains critical, as there is currently no fix available for the vulnerability.
Implications for Users and Organizations
The situation with Gogs highlights a significant risk for organizations that rely on self-hosted solutions without adequate security measures. Users should be aware that if their Gogs instances are exposed, they are vulnerable to exploitation.
Organizations should consider implementing additional security measures, such as disabling open registration and using VPNs to shield their Gogs instances. The ongoing attacks underscore the importance of regular security assessments and timely updates for self-hosted applications.
As the cybersecurity landscape evolves, organizations must remain vigilant against similar vulnerabilities that could arise in other self-hosted solutions. Continuous monitoring and prompt action in response to advisories from agencies like CISA are essential for maintaining security.
Key Takeaways
- Immediately assess if your organization is using Gogs and whether it is exposed to the internet.
- If using Gogs, implement security measures such as disabling open registration and using VPNs.
- Monitor CISA advisories for updates on the Gogs vulnerability and any available patches.
- Conduct a security audit of your self-hosted applications to identify potential vulnerabilities.
- Educate your team about the risks associated with self-hosted solutions and the importance of timely updates.
Key Terms & Concepts
- CVE-2025-8110: In this article, CVE-2025-8110 refers to a high-severity vulnerability in Gogs that allows remote code execution.
- Gogs: Gogs is a self-hosted Git service that allows users to manage Git repositories on their own servers.
- CISA: CISA is the U.S. Cybersecurity and Infrastructure Security Agency responsible for protecting the nation’s critical infrastructure from cyber threats.
- path traversal flaw: A path traversal flaw is a vulnerability that allows attackers to access files and directories outside the intended scope of an application.
- Wiz: Wiz is a cybersecurity research firm that discovered the Gogs vulnerability during an investigation into malware.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/13/cisa_gogs_exploit/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
