Veille CVE
CVE-2025-8110
8.8 Élevée Exploitée activementCatalogue CISA KEV — Gogs Path Traversal Vulnerability
Ajoutée le 12/01/2026 · Échéance de correction (agences US) : 02/02/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 8.7 Élevée | 9947ef80-c5d5-474a-bbab-97341a59000e | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X |
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit ExploitThird Party Advisory
- http://www.openwall.com/lists/oss-security/2025/12/11/3 Mailing List
- http://www.openwall.com/lists/oss-security/2025/12/11/4 Mailing List
- http://www.openwall.com/lists/oss-security/2026/01/17/4 Mailing List
- http://www.openwall.com/lists/oss-security/2026/01/18/1 Mailing List
- http://www.openwall.com/lists/oss-security/2026/01/18/2 Mailing List
- https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 Patch
- https://github.com/gogs/gogs/pull/8078 ExploitIssue TrackingPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110 Third Party AdvisoryUS Government Resource