Alerts

Gogs RCE Actively Exploited: CISA Adds CVE-2025-8110 to KEV Catalog

Zero Day Wire

12 Jan 2026 — 2 min read

Gogs, a lightweight and self-hosted Git service commonly used as an alternative to GitHub Enterprise or GitLab, has become the focus of urgent U.S. federal cybersecurity action. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Gogs vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing confirmed active exploitation in the wild.

The vulnerability, CVE-2025-8110, is a high-severity path traversal flaw that enables remote code execution. Its inclusion in the KEV Catalog triggers mandatory remediation requirements for federal agencies and serves as a strong warning to private organizations running exposed Gogs instances.

Why This Matters

Gogs is widely deployed due to its simplicity and ease of self-hosting, but many instances are exposed directly to the internet with minimal security controls. When compromised, these systems can provide attackers with access to sensitive source code, credentials, and automation scripts—often serving as a gateway to broader enterprise environments.

CVE-2025-8110 at a Glance

The vulnerability originates in Gogs’ PutContents API, which handles file writes to repositories. Authenticated attackers can abuse symbolic links to overwrite files outside repository boundaries, bypassing protections added for a previous flaw (CVE-2024-55947).

By modifying Git configuration files—specifically the sshCommand setting—attackers can execute arbitrary commands on the host system, resulting in full remote code execution.

Active Exploitation and Impact

The flaw was discovered by Wiz Research during a malware investigation involving an internet-facing Gogs server. Although reported in July, the issue was not acknowledged until late October, and patches were released only recently.

Attackers did not wait. Wiz observed active zero-day exploitation beginning November 1, with threat actors scanning for exposed Gogs instances and rapidly deploying payloads. Researchers identified over 1,400 exposed servers, more than 700 of which showed signs of compromise.

CISA Response and Federal Mandate

On January 12, 2026, CISA officially added CVE-2025-8110 to its KEV Catalog, noting that path traversal vulnerabilities are a frequent attack vector and pose significant risk to the federal enterprise.

Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities by the assigned deadline. While the directive applies only to federal agencies, CISA strongly urges all organizations to prioritize KEV remediation as part of standard vulnerability management practices.

Recommended Mitigations

Organizations running Gogs should immediately:

Apply the latest security patch
Disable open user registration
Restrict access via VPNs or IP allow lists
Audit logs for suspicious PutContents API activity

Reducing internet exposure remains the most effective risk-reduction measure.

Key Takeaway

CVE-2025-8110 highlights a growing reality: developer platforms are now high-value attack targets. Inclusion in CISA’s KEV Catalog confirms real-world exploitation and elevates this issue beyond routine patching. Organizations that treat developer tools as low-risk infrastructure are increasingly vulnerable to rapid, large-scale compromise.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors