Security researchers have identified an active zero-day vulnerability in Gogs, a widely used self-hosted Git service.
The flaw has already resulted in the compromise of more than 700 servers publicly exposed on the internet.
As of early December 2025, no official patch is available to mitigate this threat, leaving thousands of instances vulnerable to remote attacks.
Symlink Bypass Vulnerability
The vulnerability, tracked as CVE-2025-8110, allows bypassing a previously patched issue, CVE-2024-55947.
The original flaw allowed path traversal, which the maintainers attempted to fix by implementing stricter input validation on file paths. However, this new zero-day exploits a failure to validate symbolic link destinations.
Attackers with repository creation permissions can exploit this weakness by uploading a symbolic link that points outside the repository.
By using the API to write data to that symlink, they can overwrite sensitive system files.library+1
| CVE ID | Description | Severity | Status |
|---|---|---|---|
| CVE-2025-8110 | Symlink bypass allowing file overwrite outside repo | Critical | Active / Unpatched |
| CVE-2024-55947 | Previous RCE via argument injection | Critical | Patched |
In observed attacks, threat actors overwrite SSH configuration files to force the system to execute arbitrary commands, resulting in complete Remote Code Execution (RCE).
The payload was created using the Supershell framework, an open-source tool used to establish reverse SSH shells.library+1
The ongoing campaign is highly automated. Compromised servers exhibit specific artifacts, including repositories with random 8-character names created within a short timeframe.
The investigation revealed that approximately 50% of all public-facing Gogs instances observed by researchers showed signs of infection.
The threat actors are deploying the Supershell framework to maintain persistence and remotely control the compromised servers via a Command and Control (C2) server.
![From the Supershell payload we were also able to extract the attack groups C2 server
`119.45.176[.]196`](https://cyberpress.org/wp-content/uploads/2025/12/image-111-1024x246.png)
`119.45.176[.]196`
Researchers successfully extracted the attack group’s C2 server IP address from the Supershell payload, identifying the infrastructure used in this widespread exploitation.library+1
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Update
%20(1).webp?fit=1600,900&ssl=1&description=The flaw has already resulted in the compromise of more than 700 servers publicly exposed on the internet.){kind=link}