Hackers exploit unpatched Gogs zero-day to breach 700 servers

CVE-2025-8110 is an unpatched zero-day vulnerability in Gogs that stems from a path traversal weakness in the PutContents API. The flaw allows attackers to bypass protections for a previously patched RCE bug (CVE-2024-55947) by using symbolic links to overwrite files outside the repository. While Gogs versions validate path names to prevent directory traversal, they fail to validate symbolic link destinations. Attackers create repositories with symbolic links pointing to sensitive system files, then use the PutContents API to write data through the symlink, overwriting targets outside the repository. By overwriting Git configuration files, specifically the sshCommand setting, attackers can force target systems to execute arbitrary commands. The malware deployed was created using Supershell, an open-source C2 framework that establishes reverse SSH shells over web services.