Cybersecurity Alert: Active Exploitation of Gogs Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an active exploitation of a high-severity security flaw in Gogs, a self-hosted Git service. This vulnerability, tracked as CVE-2025-8110, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating its potential danger.
Vulnerability Details
The vulnerability, which has a CVSS score of 8.7, involves a path traversal issue in the repository file editor. This flaw could lead to code execution, bypassing protections put in place for another vulnerability (CVE-2024-55947).
The vulnerability was initially discovered by Wiz, who reported it being exploited in zero-day attacks. The attack method involves creating a git repository, committing a symbolic link pointing to a sensitive target, and using the PutContents API to write data to the symlink. This action causes the underlying operating system to navigate to the actual file the symlink points to and overwrites the target file outside the repository.
Impact and Affected Systems
According to Wiz, over 700 Gogs instances have been compromised due to this vulnerability. As of data from the attack surface management platform Censys, there are approximately 1,600 internet-exposed Gogs servers, with the majority located in China, the U.S., Germany, Hong Kong, and Russia.
Mitigations and Patches
Currently, there are no patches available for CVE-2025-8110. However, pull requests on GitHub show that the necessary code changes have been made, and once the image is built on main, both gogs/gogs:latest and gogs/gogs:next-latest will have this CVE patched.
In the meantime, Gogs users are advised to disable the default open-registration setting and limit server access using a VPN or an allow-list. For Federal Civilian Executive Branch (FCEB) agencies, necessary mitigations must be applied by February 2, 2026.
Relevance to North East India and Broader Indian Context
While the majority of the compromised Gogs instances are located outside India, the vulnerability serves as a reminder of the importance of cybersecurity for all organizations, including those in North East India. As more organizations adopt cloud-based services and Git repositories, it is crucial to stay informed about potential security threats and take necessary precautions to protect sensitive data.
Looking Forward
As the digital landscape continues to evolve, so too will the tactics used by cybercriminals. It is essential for organizations to stay vigilant and proactive in their cybersecurity measures. By staying informed about known vulnerabilities and taking appropriate steps to secure their systems, organizations can help protect themselves against potential threats.