Gogs Zero-Day RCE (CVE‑2025‑8110) Lets Authenticated Users Overwrite Files and Execute Code
Wiz Research uncovered a critical zero‑day in the self‑hosted Git service Gogs, where authenticated users can exploit a symlink bypass to write arbitrary files outside a repository, leading to remote code execution. Over 700 publicly‑exposed Gogs instances were found compromised before a fix was released in v0.13.4.