Do Son Public proof-of-concept code targets three Gogs RCE vulnerabilities scoring up to CVSS 10. Update self-hosted Gogs to version 0.14.3 right now.
Gogs
A critical 9.3 CVSS flaw (CVE-2026-25921) in Gogs' LFS handling allows attackers to silently overwrite repository files, risking severe supply-chain attacks.
Critical Gogs flaws (CVE-2025-64111) allow RCE & 2FA bypass. Attackers can execute commands via .git config. Update to v0.13.4 immediately.
CISA warns: Active exploits target Gogs Git service via CVE-2025-8110 (CVSS 8.7). Attackers use symlink bypass for RCE. Patch by Feb 2, 2026.
A Gogs zero-day (CVE-2025-8110) bypasses a previous patch, enabling RCE via symlink path traversal. Over 50% of exposed instances are compromised, deploying the Supershell C2. Disable open registration immediately.
Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.
Stay informed about the recently discovered security vulnerabilities in Gogs. Explore the impacts of CVE-2024-39930 and other critical CVEs.
SonarSource, a leading code security firm, has uncovered four unpatched vulnerabilities in Gogs, a popular open-source self-hosted Git service