Latest Gogs vulnerability: CVE-2026-25921 #
Gogs has disclosed that certain versions are affected by a cross-repository Large File Storage (LFS) object overwrite vulnerability due to missing content hash verification. Git LFS is an open-source extension designed to manage large files, such as audio samples, videos, and datasets, more efficiently within Git repositories. Because Gogs stores all LFS objects in a single location without repository isolation, this flaw could allow a remote, unauthenticated adversary to overwrite existing objects. The vulnerability has been designated CVE-2026-25921 and has been rated critical with a CVSS score of 9.3.
The following versions are affected
- Gogs versions prior to 0.14.2
What is Gogs?
#
Gogs is an open-source, self-hosted Git repository management system written in Go that provides a web-based interface for version control with minimal hardware resource requirements.
What is the impact? #
Successful exploitation of the vulnerability enables an adversary to overwrite legitimate LFS objects with malicious content. This introduces a significant risk of a supply-chain attack; because the Gogs web interface does not present integrity warnings, users may unknowingly download and utilize compromised assets.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Gogs upgrade to version 0.14.2 or later
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Gogs AND product:=GogsDecember 2025: CVE-2025-8110 #
Security researchers at Wiz have reported a 0-day vulnerability in Gogs. This flaw allows remote, authenticated attackers to overwrite arbitrary files on the vulnerable system. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code on the vulnerable system with the privileges of the Gogs server process.
This vulnerability has been assigned CVE-2025-8110 and has a CVSS score of 7.8.
Note that there is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected
- Gogs versions 0.13.3 and prior
What is Gogs? #
Gogs is a self-hosted Git software forge, allowing users to collaborate on development using Git repositories.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
There is currently no patched fixed version of Gogs available. Users are encouraged to disable auto-registration of users and avoid Internet exposure for any Gogs installations.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:=http AND protocol:=http AND favicon.ico.image.md5:=5f5b7539f014b9996959f5dcd063d383
