security_identifier

CVE-2025-8110

Gogs 0-day reported by Wiz allowing authenticated arbitrary file overwrite and code execution, CVSS 7.8, reported as actively exploited.

Current clusters

build1 distinct publisher

Gogs checks the path, then follows the symlink out of the repository

The patch for the last Gogs RCE validated the path parameter and never looked at where a committed symlink pointed. Wiz counted more than 700 already-compromised instances before v0.13.4 shipped.

Publishers:wiz.io

Reality

Evidence72
Adoption74
Hype gap+12
Incentives68

security2 distinct publishers

CVE-2026-52806 turns a Gogs branch name into command execution as the git user

Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.

Publishers:rapid7.comrunzero.com

Reality

Evidence84
Adoption52