Sploitus

Exploit for Path Traversal in Gogs

CVE-2025-8110

githubexploit · 2026-08-05

Exploit Code

README29 lines
## https://sploitus.com/exploit?id=F9DD4247-760F-5259-9290-3E4EF65DABAB
# CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC

Proof-of-Concept for **CVE-2025-8110**, an authenticated arbitrary file write in Gogs ≤ 0.13.3 caused by improper symbolic-link handling in the PutContents API.

An authenticated user can commit a symlink pointing to `.git/config`, then use the API to overwrite it and inject a malicious `sshCommand`, resulting in remote code execution.
## Disclaimer

For educational and authorized testing only. Do not use against systems you do not own or have explicit permission to test.
## Usage

```bash
chmod +x poc.sh

./poc.sh \
  -i  \
  -P  \
  -u  \
  -p  \
  -t  \
  -c "" \
  [-r ]   # optional, default: CVE-2025-8110
````

## References

- [Wiz Research blog – original disclosure](https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit)
- [NVD – CVE-2025-8110](https://nvd.nist.gov/vuln/detail/CVE-2025-8110)
- [Gogs patch commit](https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6)