Exploit for Path Traversal in Gogs

CVE-2025-8110

githubexploit · 2026-04-14

Description

This describes a path traversal vulnerability exploit in Gogs.

Entry point

Parametercontent · path

Pathapi/v1/repos/<owner>/<repo>/contents/*

Symlink-following flaw in PUT contents API allows writing through a symlink (e.g., to .git/config) enabling RCE when combined with a subsequent push.

Affected Gogs versions

Gogs≤ 0.13.3

All known vulnerabilities by product

Gogs

CVSS 8.8 for CVE-2025-8110

8.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:LOW

User Interaction:NONE

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

82.7%higher than 99.6% of all CVEs

Updated 2026-08-08

Exploit Details

Modified:2026-04-14 11:06

Last Seen:2026-04-14 11:29

Reporter:NetsecBandit

Repository:No longer on GitHub

Other exploits for CVE-2025-8110

cve-2025-8110-GOGS-RCE

2026-09-02 KitPloitKITPLOIT

CVE-2025-8110-PoC

2026-09-02 KitPloitKITPLOIT

CVE-2025-8110

2026-09-02 KitPloitKITPLOIT

HTB-Silentium-Writeup

2026-09-02 KitPloitKITPLOIT

CVE-2025-8110

2026-09-02 KitPloitKITPLOIT

goga-cve-2025-8110

2026-09-01 KitPloitKITPLOIT

CVE-2025-8110

2026-09-01 KitPloitKITPLOIT

CVE-2025-8110-Gogs-RCE-Exploit

2026-09-01 KitPloitKITPLOIT

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=15424190-3182-5B6D-944B-099F8048B472
No description provided

Exploit Code

Share

Share on social media: