CVE-2025-8110
actively exploitedImproper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
-
exploitation prediction scoring system. probability this vulnerability will be exploited in the wild in the next 30 days.
cvss
common vulnerability scoring system v3.1. measures intrinsic severity on a 0-10 scale.
epss
0.2105
kev
yes
cisa known exploited vulnerabilities catalog. confirmed active exploitation.
CVSS 4.0
Common Vulnerability Scoring System v4.0
8.7
/ 10
HIGH
exploitability
Attack Vector
Network
Attack Vector (AV:N): exploitable remotely over the network — most dangerous. no physical or adjacent access needed.
Attack Complexity
Low
Attack Complexity (AC:L): no special conditions needed. attack can be reliably reproduced.
Attack Requirements
None
Attack Requirements (AT:N): no special deployment or execution conditions needed.
Privileges Required
Low
Privileges Required (PR:L): requires basic user-level access.
User Interaction
None
User Interaction (UI:N): no victim action needed. fully exploitable without user interaction.
vulnerable system impact
Vuln Confidentiality
High
Confidentiality (VC:H): total information disclosure. attacker gains access to all data within the component.
Vuln Integrity
High
Integrity (VI:H): complete data modification possible. attacker can modify any data.
Vuln Availability
High
Availability (VA:H): total denial of service. attacker can fully shut down the resource.
subsequent system impact
Sub Confidentiality
None
Subsequent Confidentiality: impact on data confidentiality of downstream/connected systems. Value: N (None)
Sub Integrity
None
Subsequent Integrity: impact on data integrity of downstream/connected systems. Value: N (None)
Sub Availability
None
Subsequent Availability: impact on service availability of downstream/connected systems. Value: N (None)
supplemental
exploit maturity: attacked
Exploit Maturity: has a functional exploit been observed? Attacked = actively exploited. PoC = proof-of-concept exists. Unreported = no known exploit.
supplemental
automatable: yes
Automatable: can this be exploited at scale through automation?
supplemental
recovery: user
Recovery: how easily can the system recover? Automatic = self-healing. User = manual intervention. Irrecoverable = permanent.
supplemental
value density: concentrated
Value Density: are targets concentrated (database server) or diffuse (end-user devices)?
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/R:U/V:C
activity density
rdintel assessment
actively exploited. patch immediately.
flagged malicious repos detected. do not execute.
detection rules available.
composite score from 15+ signals including exploitation status, epss probability, detection coverage, and community attention. 0-100 scale.
sign in to view full intelligence
pocs, detection rules, timeline, advisories, and more