Forgejo before 16.0.4 allows remote code execution via a crafted template repository

Published September 10, 2026 CVE-2026-89094

Forgejo can let someone with permission to create repositories read files and run commands on its server. The risk comes from creating a repository from a specially prepared template.

Severity
CriticalCVSS 3.1 · 9.9
Fix
Fixed in 16.0.4
Affected versions
16.0.0 to before 16.0.4; before 15.0.8
Weakness
CWE-1336
Exploit likelihood
0.50% in 30 daysEPSS, higher than 41% of known flaws
Affects
Forgejo
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-75732ENISA vulnerability database

How it works

  • A user creates a new repository from a malicious template repository.
  • Forgejo expands template variables before creating the repository's Git metadata.
  • The expansion can create a new .git folder, which Git then adopts during initialization.
  • That can expose server files and allow commands to run on the Forgejo host.

What to do

Check the Forgejo version used by your installation and compare it with the affected ranges in the CVE record. Also confirm whether untrusted users can create repositories from templates.

Update Forgejo to 16.0.4 or 15.0.8, depending on your release branch. Restrict repository creation to trusted users until the update is complete.

Technical details

The flaw occurs while Forgejo expands variables in files under .forgejo/template during repository creation. A crafted template can recreate .git before Git initializes the new repository, enabling arbitrary file reads and command execution on the host.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source