High · published December 10, 2025
CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
⚡ Watch out! Improper symbolic link handling in Gogs' PutContents API could let attackers execute code right on your server! 🔥 Think of it like a delivery person who accidentally leaves a package at the wrong address, allowing an unauthorized party to open it and tamper with its contents. This vulnerability essentially gives the attacker a key to unlock the server's commands! An attacker can exploit this flaw to execute arbitrary code, which could lead to a complete takeover of the system! Imagine malicious actors accessing sensitive data or manipulating server operations as if they had insider access — absolutely devastating!
Think of it like a delivery person who accidentally leaves a package at the wrong address, allowing an unauthorized party to open it and tamper with its contents. This vulnerability essentially gives the attacker a key to unlock the server's commands! This vulnerability in Gogs arises from improper handling of symbolic links in the PutContents API, allowing local code execution by tricking the application into following an unexpected file path.
An attacker can exploit this flaw to execute arbitrary code, which could lead to a complete takeover of the system! Imagine malicious actors accessing sensitive data or manipulating server operations as if they had insider access — absolutely devastating! To safeguard your system, immediately patch Gogs to the latest version, which resolves this issue. Additionally, review permissions on your symbolic links to ensure they’re appropriately restricted. 🔒 This is fixable! Just follow these steps, and you'll have your Gogs installation secured in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gogs/gogs | ≤ 0.13.3 | — |