CVE-2026-89094 Details

A remote code execution vulnerability exists in Forgejo versions prior to 16.0.4. The issue arises from improper handling of template expansion on files listed in '.forgejo/template' within template repositories. When a new repository is created from a template, Forgejo clones the template, removes the '.git' folder, and performs variable expansion before initializing a new git repository. This process can be exploited by a malicious template repository to create a new '.git' folder, which Git would incorporate during repository initialization. As a result, arbitrary data could be read from the Forgejo host, and arbitrary processes could be executed, leading to remote code execution.

Users should update to Forgejo version 16.0.4 or later, where this vulnerability has been fixed. For those on version 15 LTS, the update to version 15.0.8 addresses this issue.