Exploit for CVE-2025-8110-Gogs-Remote-Code-Execution

kitploit · 2026-08-28

Description

Command injection in Gogs pre-0.13.0 Git post-receive hooks enables RCE with push access.

Entry point

Parametercontent · path

Pathapi/v1/repos/<owner>/<repo>/contents/*

Symlink-following flaw in PUT contents API allows writing through a symlink (e.g., to .git/config) enabling RCE when combined with a subsequent push.

Affected Gogs versions

Gogs≤ 0.13.3

All known vulnerabilities by product

CVSS 8.8 for CVE-2025-8110

8.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:LOW

User Interaction:NONE

EPSS Score

82.7%higher than 99.6% of all CVEs

Updated 2026-09-03

CVE Information

Exploit Details

Modified:2026-08-28 08:12

Last Seen:2026-08-28 12:57

Reporter:KitPloit

Tags

GogsCommand injectionGit hooksRemote code executionpost-receive

Other exploits for CVE-2025-8110

CVE-2025-8110-Silentium-HTB

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

CVE-2025-8110-PoC

2026-09-02 KitPloitKITPLOIT

cve-2025-8110-GOGS-RCE

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

HTB-Silentium-Writeup

2026-09-02 KitPloitKITPLOIT

2026-09-01 KitPloitKITPLOIT

goga-cve-2025-8110

2026-09-01 KitPloitKITPLOIT

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GEORGE0PAPASOTIRIOU-CVE-2025-8110-GOGS-REMOTE-CODE-EXECUTION
# Software interessato: Gogs (servizio Git self-hosted) versioni precedenti alla 0.13.0.

# Tipo di vulnerabilità: Iniezione di comandi nel meccanismo dei Git hook.

# Descrizione: Un aggressore con accesso push a un repository può creare un Git hook dannoso che inietta comandi nello script dell'hook post-receive, portando all'esecuzione remota di codice sul server Gogs.