1## autogenerated on 2026-01-21 14:30:55
2name: crowdsecurity/vpatch-CVE-2025-8110
3description: 'Detects symlink bypass vulnerability in Gogs PutContents API allowing file overwrite and potential RCE (CVE-2025-8110)'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /api/v1/repos/
13      - zones:
14          - URI
15        transform:
16          - lowercase
17        match:
18          type: contains
19          value: /contents/
20      - zones:
21          - URI
22        transform:
23          - urldecode
24          - lowercase
25        match:
26          type: contains
27          value: '../'
28
29labels:
30  type: exploit
31  service: http
32  confidence: 3
33  spoofable: 0
34  behavior: 'http:exploit'
35  label: 'Gogs - RCE'
36  classification:
37    - cve.CVE-2025-8110
38    - attack.T1190
39    - cwe.CWE-59
40