Federal agencies told to fix or ditch Gogs as exploited zero-day lands on CISA hit list

CISA has ordered federal agencies to stop using or lock down Gogs after a high-severity path traversal vulnerability (CVE-2025-8110) — which allows authenticated users to overwrite arbitrary files and achieve remote code execution via symlink bypass — was added to the Known Exploited Vulnerabilities catalog; researchers report active exploitation with more than 700 confirmed compromised instances and roughly 1,400 internet-reachable servers, and Gogs has not yet released a fix, leaving users to apply mitigations such as disabling registration or shielding instances behind VPNs.