Gogs Symlink Zero-Day Exploited to Compromise More Than 700 Exposed Instances

Summary

Wiz researchers traced attacks exploiting Gogs CVE-2025-8110 to a symlink bypass that enables remote code execution, finding more than 700 compromised instances. Gogs fixed the vulnerability in v0.13.4.

Key points

CVE-2025-8110 bypasses a prior path-validation fix for CVE-2024-55947: an authenticated user with repository creation permissions can use a symlink and the PutContents API to overwrite files outside a repository.
Overwriting .git/config, including its sshCommand setting, can enable arbitrary command execution.
Wiz reported more than 700 compromised instances among roughly 1,400 publicly exposed Gogs servers it examined; the researchers said the infections shared a pattern of randomly named repositories.
The investigation found Supershell malware, which the article describes as establishing a reverse SSH shell for remote control and command execution.
The researchers found a Supershell C2 address, 119.45.176[.]196, and payload-server addresses, 106.53.108[.]81 and 119.91.42[.]53.
The shared infection pattern suggests one actor or multiple actors using the same tooling; the article does not establish a definitive attribution.
Gogs released version v0.13.4 with a fix on January 23, 2026. The article advises upgrading, or disabling open registration and restricting internet exposure if an immediate upgrade is not possible.

Article Details

Attack Vectors: An attacker with repository creation permissions creates a Git repository containing a symbolic link to a file outside the repository, then uses Gogs' PutContents API to overwrite the linked file.
Overwriting .git/config, specifically sshCommand, can cause the system to execute arbitrary commands.
The article reports exploitation of internet-exposed Gogs instances with open registration enabled; it identified more than 700 compromised instances among approximately 1,400 exposed instances.
Defensive Notes: Upgrade Gogs to version v0.13.4 or later.
If immediate upgrading is not possible, disable open registration.
Limit internet exposure by placing self-hosted Git services behind a VPN or restricting access with an IP allow-list.
Look for repositories with unexpected random 8-character names and unexpected use of the PutContents API.

Indicators of compromise

Type	Indicator	Context
IPV4	`106[.]53[.]108[.]81`	Identified in the article as a payload server.
IPV4	`119[.]45[.]176[.]196`	Supershell C2 server extracted from the payload.
IPV4	`119[.]91[.]42[.]53`	Identified in the article as a payload server.
SHA1	`d8fcd57a71f9f6e55b063939dc7c1523660b7383`	SHA-1 hash identified in the article as malware.
SHA1	`efda81e1100ea977321d0f2eeb0dfa7a6b132abd`	SHA-1 hash identified in the article as malware.