{"history":[{"alert":0,"cve":"CVE-2025-8110","id":22889,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.80252, \"percentile\": 0.99625}"},{"alert":0,"cve":"CVE-2025-8110","id":20509,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.80252, \"percentile\": 0.99623}"},{"alert":0,"cve":"CVE-2025-8110","id":18477,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.85202, \"percentile\": 0.99717}"},{"alert":0,"cve":"CVE-2025-8110","id":16543,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.85202, \"percentile\": 0.99717}"},{"alert":0,"cve":"CVE-2025-8110","id":14521,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.85202, \"percentile\": 0.99716}"},{"alert":0,"cve":"CVE-2025-8110","id":12303,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.85202, \"percentile\": 0.99716}"},{"alert":0,"cve":"CVE-2025-8110","id":10289,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.85202, \"percentile\": 0.99716}"},{"alert":0,"cve":"CVE-2025-8110","id":7838,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.85202, \"percentile\": 0.99716}"},{"alert":0,"cve":"CVE-2025-8110","id":5615,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.85202, \"percentile\": 0.99715}"},{"alert":1,"cve":"CVE-2025-8110","id":3936,"kind":"cna","observed_at":1793701200,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2025-8110\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-01-13T04:55:48.537174Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-01-12\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-02-26T16:21:06.106Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"issue-tracking\"], \"url\": \"https://github.com/gogs/gogs/pull/8078\"}, {\"tags\": [\"patch\"], \"url\": \"https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-01-12T00:00:00.000Z\", \"value\": \"CVE-2025-8110 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}, {\"providerMetadata\": {\"dateUpdated\": \"2026-01-18T03:33:12.743Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/12/11/3\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/12/11/4\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/01/17/4\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/01/18/1\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/01/18/2\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"packageName\": \"Gogs\", \"platforms\": [\"Linux\", \"Windows\"], \"product\": \"Gogs\", \"repo\": \"https://github.com/gogs/gogs\", \"vendor\": \"Gogs\", \"versions\": [{\"lessThanOrEqual\": \"0.13.3\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"git\"}]}], \"datePublic\": \"2025-12-10T13:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.\"}], \"value\": \"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.\"}], \"impacts\": [{\"capecId\": \"CAPEC-549\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-549 Local Execution of Code\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"YES\", \"Recovery\": \"USER\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"attackVector\": \"NETWORK\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"exploitMaturity\": \"ATTACKED\", \"privilegesRequired\": \"LOW\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-12-10T19:42:39.728Z\", \"orgId\": \"9947ef80-c5d5-474a-bbab-97341a59000e\", \"shortName\": \"Wiz\"}, \"references\": [{\"url\": \"http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit\"}], \"source\": {\"discovery\": \"USER\"}, \"title\": \"File overwrite in file update API in Gogs\", \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"9947ef80-c5d5-474a-bbab-97341a59000e\", \"assignerShortName\": \"Wiz\", \"cveId\": \"CVE-2025-8110\", \"datePublished\": \"2025-12-10T13:23:46.777Z\", \"dateReserved\": \"2025-07-24T10:02:24.954Z\", \"dateUpdated\": \"2026-02-26T16:21:06.106Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2025-8110","id":3408,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.85202, \"percentile\": 0.99715}"},{"alert":1,"cve":"CVE-2025-8110","id":280,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2025-8110\", \"cwes\": [\"CWE-22\"], \"dateAdded\": \"2026-01-12\", \"dueDate\": \"2026-02-02\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8110\", \"product\": \"Gogs\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.\", \"vendorProject\": \"Gogs\", \"vulnerabilityName\": \"Gogs Path Traversal Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","packageName":"Gogs","platforms":["Linux","Windows"],"product":"Gogs","repo":"https://github.com/gogs/gogs","vendor":"Gogs","versions":[{"lessThanOrEqual":"0.13.3","status":"affected","version":"0","versionType":"git"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-8110","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-01-13T04:55:48.537174Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-01-12","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-02-26T16:21:06.106Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["issue-tracking"],"url":"https://github.com/gogs/gogs/pull/8078"},{"tags":["patch"],"url":"https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110"}],"timeline":[{"lang":"en","time":"2026-01-12T00:00:00.000Z","value":"CVE-2025-8110 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-01-18T03:33:12.743Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2025/12/11/3"},{"url":"http://www.openwall.com/lists/oss-security/2025/12/11/4"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/17/4"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/18/1"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/18/2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"Gogs","platforms":["Linux","Windows"],"product":"Gogs","repo":"https://github.com/gogs/gogs","vendor":"Gogs","versions":[{"lessThanOrEqual":"0.13.3","status":"affected","version":"0","versionType":"git"}]}],"datePublic":"2025-12-10T13:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code."}],"value":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code."}],"impacts":[{"capecId":"CAPEC-549","descriptions":[{"lang":"en","value":"CAPEC-549 Local Execution of Code"}]}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"ATTACKED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-12-10T19:42:39.728Z","orgId":"9947ef80-c5d5-474a-bbab-97341a59000e","shortName":"Wiz"},"references":[{"url":"http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit"}],"source":{"discovery":"USER"},"title":"File overwrite in file update API in Gogs","x_generator":{"engine":"Vulnogram 0.5.0"}}},"cveMetadata":{"assignerOrgId":"9947ef80-c5d5-474a-bbab-97341a59000e","assignerShortName":"Wiz","cveId":"CVE-2025-8110","datePublished":"2025-12-10T13:23:46.777Z","dateReserved":"2025-07-24T10:02:24.954Z","dateUpdated":"2026-02-26T16:21:06.106Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794133200,"cve":"CVE-2025-8110","description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","epss":{"date":"2026-11-12","epss":0.80252,"percentile":0.99625},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2025-8110","cwes":["CWE-22"],"dateAdded":"2026-01-12","dueDate":"2026-02-02","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8110","product":"Gogs","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.","vendorProject":"Gogs","vulnerabilityName":"Gogs Path Traversal Vulnerability"},"kev_checked":1794522003,"products":"Gogs Gogs","references":["http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","https://github.com/gogs/gogs/pull/8078","https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110","http://www.openwall.com/lists/oss-security/2025/12/11/3","http://www.openwall.com/lists/oss-security/2025/12/11/4","http://www.openwall.com/lists/oss-security/2026/01/17/4","http://www.openwall.com/lists/oss-security/2026/01/18/1","http://www.openwall.com/lists/oss-security/2026/01/18/2"],"score":{"Automatable":"YES","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"ATTACKED","privilegesRequired":"LOW","provider":"Wiz","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"solutions":"","state":"PUBLISHED","title":"File overwrite in file update API in Gogs","updated_at":1794500401,"workarounds":""},"sources":[]}