Gogs, an open-source Git server, has been hit with a critical zero-day vulnerability that could allow attackers to gain remote code execution (RCE) capabilities. This flaw, which has not yet been assigned a CVE ID, affects all Gogs releases up to and including 0.14.2 and 0.15.0+dev. The vulnerability is an argument injection flaw, which can be exploited by authenticated attackers without admin privileges, and it poses a significant risk to Gogs servers with default configurations.
The vulnerability allows attackers to compromise the targeted server, read any repository (including private ones), steal credentials, move laterally to other systems on the network, and alter any hosted source code. While threat actors would need at least basic user privileges to exploit the flaw, Rapid7 security researcher Jonah Burgess, who discovered and reported it, warned that it affects all Gogs servers with default configurations.
Burgess explained that Gogs ships with open registration enabled by default and no limit on repository creation, which means an unauthenticated attacker can create an account and repository on any default-configured instance. Any registered user who creates a repo is automatically its owner, and enabling rebase merging is a single toggle in settings, allowing the entire exploit chain to be operated without interaction from any other user.
The Gogs maintainers released version 0.14.3 on June 7 to patch this flaw and requested a CVE ID. Rapid7 recommends that all Gogs users upgrade immediately, and they shared mitigation measures for users who cannot patch their Gogs instances immediately. These measures include restricting user registration, limiting repository creation, and auditing rebase merge settings.
This flaw is similar to other argument-injection flaws that the Gogs security team has patched in recent years, but it affects a different code path (Merge()) that was never addressed. Gogs has a history of RCE vulnerabilities, with another being patched in early December 2026 after it was exploited in zero-day attacks to compromise hundreds of servers.
The CISA confirmed that CVE-2025-8110 was being abused in the wild and added it to its catalog of actively exploited vulnerabilities, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three weeks. This highlights the ongoing threat posed by such vulnerabilities and the need for proactive security measures.
In conclusion, the Gogs zero-day vulnerability is a serious concern for organizations using this open-source Git server. It underscores the importance of keeping software up-to-date and implementing robust security measures to prevent unauthorized access and potential data breaches.
