# Gogs 0-Day Exploited in the Wild

Symlink bypass of Gogs PutContents path validation lets authenticated users overwrite files outside the repo, achieving RCE; 700+ instances compromised in the wild.

- Payout: Real-world hack
- Severity: critical
- Program: Gogs
- Credited: Wiz Research
- Disclosed: 2025-12-10
- CVE: CVE-2025-8110
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-gogs-cve-2025-8110-rce-exploit
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:go technique:chained technique:incomplete-fix vuln:path-traversal vuln:rce

**Target:** Gogs self-hosted Git service PutContents API
**Root cause:** The fix for CVE-2024-55947 validated the path parameter but did not check whether the write target is a symlink pointing outside the repository, so PutContents follows the link and overwrites arbitrary files.
**Steps:**
1. Create a git repository (open registration enabled by default).
2. Commit a symbolic link pointing to a sensitive target file outside the repo.
3. Call the PutContents API writing data to the symlink path; Gogs follows the link and overwrites the target.
4. Overwrite `.git/config` setting `sshCommand` to an arbitrary command to trigger execution.
**How found:** Started from malware findings on a customer workload; found a public Gogs 0.13.2 (immune to prior CVE) with suspicious random 8-char repos created five days prior matching infection timestamps, leading to analysis of the symlink bypass.
**Exploitation:** Attacker with repo-creation permission commits a symlink to a target file, then uses PutContents to overwrite `.git/config`'s sshCommand, forcing command execution; malware (Supershell C2, garbled Go binary) deployed on 700+ exposed instances via automated smash-and-grab campaign creating random 8-char repos.
**Escalation:** Chained from file-write primitive to RCE via .git/config sshCommand overwrite; scaled across ~1,400 exposed instances with 700+ confirmed compromised.
**Insight:** When a path-traversal fix only validates the path string, test whether the destination is a symlink — Git repos legitimately store symlinks, so any API writing to repo paths must resolve and re-check the link target.