U.S. CISA adds a flaw in Gogs to its Known Exploited Vulnerabilities catalog

CISA added CVE-2025-8110 — a Gogs symlink handling/path traversal flaw enabling authenticated remote code execution — to its Known Exploited Vulnerabilities catalog after Wiz researchers, investigating a malware incident, found active exploitation and identified roughly 1,400 exposed instances with over 700 compromised. The vulnerability bypasses an earlier patch by leveraging Git symlinks to overwrite files outside repositories; agencies are directed to remediate by the CISA deadline.