## https://sploitus.com/exploit?id=818B9529-4D90-5B49-949D-DFDFF5E93C3E
# CVE-2025-8110 - Gogs symlink bypass -> arbitrary file write as the Gogs process user
Gogs //contents/`). Gogs follows the symlink and
writes attacker-controlled bytes to the link target with the privileges of the
Gogs process. When Gogs runs as root this is an arbitrary root file write -
e.g. drop a `NOPASSWD` rule into `/etc/sudoers.d/` for local privilege
escalation.
Reported by Wiz Research.
**CVE:** CVE-2025-8110
## Requirements
```bash
python3 -m pip install requests pillow # gogs_register.py (captcha OCR)
# plus a `tesseract` binary on PATH (or edit the R= path in gogs_register.py)
```
## Usage
### `gogs_register.py` - get an authenticated account past the signup captcha
```bash
python3 gogs_register.py [username] [password] # defaults: pocuser / PocPass123!
# targets http://127.0.0.1:3001 - edit B= for a remote instance
```
### `gogs_symlink_root.sh` - the symlink write
```bash
./gogs_symlink_root.sh [sudo-user]
# sudo-user defaults to the current user; writes /etc/sudoers.d/
# run on the target host (git + curl available, Gogs reachable on 127.0.0.1:3001)
```
## References
- https://www.wiz.io/vulnerability-database/cve/cve-2025-8110
- NVD: CVE-2025-8110
## Disclaimer
For authorised security testing and education only. Only run this against
systems you own or have **explicit written permission** to test.
---
Author: **r3vpwnx**