GHSA-mq8m-42gh-wq7r
Gogs vulnerable to a bypass of CVE-2024-55947
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | gogs.io/gogs | <= 0.13.3 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-8110
- https://github.com/gogs/gogs/pull/8078
- https://github.com/gogs/gogs/pull/8082
- https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6
- https://github.com/advisories/GHSA-mq8m-42gh-wq7r
- https://github.com/gogs/gogs
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110
- http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- http://www.openwall.com/lists/oss-security/2025/12/11/3
- http://www.openwall.com/lists/oss-security/2025/12/11/4
- http://www.openwall.com/lists/oss-security/2026/01/17/4
- http://www.openwall.com/lists/oss-security/2026/01/18/1
- http://www.openwall.com/lists/oss-security/2026/01/18/2