The CVE-2025-8110 zero-day vulnerability in Gogs, a popular self-hosted Git service, enables remote code execution through a symlink bypass flaw. This vulnerability specifically affects Gogs versions up to 0.13.3 when open user registration is enabled and the service is exposed to the internet. The attack vector involves authenticated users creating repositories containing symbolic links that point outside the repository directory. By leveraging the PutContents API, attackers can overwrite arbitrary files on the host system beyond the repository scope. This file overwrite capability allows attackers to place malicious payloads or modify critical system files, ultimately leading to remote code execution and full system compromise. The active exploitation campaign has resulted in over 700 compromised instances worldwide, with attackers deploying malware based on the Supershell framework to establish persistent reverse SSH shells, enabling ongoing control and lateral movement. The vulnerability is particularly dangerous because it requires only authenticated access, which can be obtained via open registration, and does not require complex user interaction beyond repository creation. The threat actor group identified as China-Nexus is linked to this exploitation, indicating a potential state-sponsored campaign targeting critical infrastructure and organizations. Mitigation strategies focus on disabling open registration to prevent unauthorized account creation, restricting Gogs instances from internet exposure through network segmentation or firewall rules, and implementing monitoring for unusual repository activity such as creation of symbolic links or unexpected file overwrites. Despite the medium severity rating, the combination of ease of exploitation, broad impact, and active exploitation justifies urgent attention from administrators of Gogs instances.

For European organizations, the impact of this vulnerability can be severe. Organizations using Gogs with open registration and internet exposure risk full system compromise, leading to potential data breaches, intellectual property theft, and disruption of development workflows. The deployment of Supershell-based malware enables attackers to maintain persistent access, conduct lateral movement, and potentially escalate privileges within the network. This can result in loss of confidentiality, integrity, and availability of critical systems. Given that Gogs is often used in software development environments, exploitation could also compromise source code repositories, impacting software supply chain security. The breach of development infrastructure can have cascading effects on product security and operational continuity. Additionally, the involvement of a state-linked adversary group suggests targeting of strategic sectors, increasing the risk for organizations in critical infrastructure, government, and technology sectors across Europe. The active exploitation and the number of compromised instances highlight the urgency for European organizations to assess their exposure and implement mitigations promptly.

1. Immediately disable open user registration on all Gogs instances to prevent unauthorized account creation. 2. Restrict internet exposure of Gogs servers by placing them behind firewalls, VPNs, or internal networks accessible only to trusted users. 3. Monitor repository creation and updates for suspicious activity, specifically the creation of symbolic links or unusual file overwrite attempts. 4. Implement strict access controls and authentication mechanisms, including multi-factor authentication, to reduce risk of unauthorized access. 5. Regularly audit and review Gogs server logs for signs of exploitation or abnormal behavior. 6. If possible, upgrade to a patched version of Gogs once available or apply vendor-provided mitigations. 7. Employ endpoint detection and response (EDR) tools to detect and respond to malware such as Supershell. 8. Conduct network segmentation to limit lateral movement in case of compromise. 9. Educate development teams about the risks of open registration and encourage secure configuration practices. 10. Prepare incident response plans specifically addressing potential compromise of development infrastructure.