CVE-2025-81110

Search associated code STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC to CVE-2025-81110.

Exploitation context

Available material

Repository PoCs
1

Proofs of concept

1

Repository PoCs

GitHubBridgerAlderson/CVE-2025-81110-PoCRepository PoCby BridgerAlderson4Exploit3 files

11.0 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2024-39930 in Gogs by creating a symlink to a Git hook via the API, overwriting the hook with a malicious payload, and triggering it to achieve RCE (reverse shell or SUID binary).

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2025-81110.py) and its README.md. The script implements a documented proof-of-concept for CVE-2025-81110, targeting a Gogs server vulnerability. It uses provided credentials to create a repository, push a symlink, overwrite a server-side Git hook via the API, and trigger execution. The payloads are a SUID bash copy or a reverse shell, both standard post-exploitation actions consistent with the stated vulnerability. No concealed, deceptive, or unrelated harmful behavior was observed in the reviewed text.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareGogs
Attack typesRemote Code ExecutionPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script performs a multi-step attack that authenticates, creates a repository, pushes a symlink, overwrites a server-side Git hook with attacker-controlled code, and triggers its execution. This is active exploitation, not just detection or scanning.

CVE-2025-81110.py:38-66README.md:4

Requirements

  • Valid Gogs credentials (username and password) for an authenticated user.CVE-2025-81110.py:168-169
  • Target Gogs instance URL.CVE-2025-81110.py:167
  • Python 3.x, requests library, and git command-line tool on the attacker machine.README.md:13-15

Observed behavior

  • Authenticates to the Gogs API and creates an API token.CVE-2025-81110.py:67-77
  • Creates an empty repository with auto_init disabled.CVE-2025-81110.py:79-97
  • Creates a local symlink pointing to the server-side pre-receive Git hook and pushes it to the repository.CVE-2025-81110.py:99-122
  • Overwrites the symlink content via the API, which follows the link and writes a malicious script (reverse shell or SUID bash copy) into the pre-receive hook.CVE-2025-81110.py:135-148
  • Triggers the hook by performing a final Git push, causing the server to execute the malicious script.CVE-2025-81110.py:150-163
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
SUID binary creation (/tmp/rootbash) and reverse shell (bash -i >& /dev/tcp/.../... 0>&1)These are the intended post-exploitation actions for the CVE, not a backdoor hidden within the PoC itself.CVE-2025-81110.py:138-140
Target Behavior
Script targets a remote Gogs server using user-supplied credentials and URL.The script's behavior is directed at the specified target, not the operator's machine.CVE-2025-81110.py:13-19CVE-2025-81110.py:166-173
Review boundaries

What the analysis did not establish

  • One file (total 3) omitted from text content; metadata indicates it is a non-text file (likely binary).
  • CVE-2025-81110 record was absent from the acquired CVEList V5 dataset.
  • The artifact references CVE-2024-39930 in its banner, not CVE-2025-81110.
  • One file (unclassified, 1068 bytes) was omitted from the text evidence; its content is unknown.
  • The review is based solely on static analysis of the provided text; the script was not executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.