Forgejo Fixes Critical Flaw Allowing Remote Code Execution via Templates

Forgejo has addressed a critical remote code execution flaw tracked as CVE-2026-89094, with Forgejo version 16.0.4 released on 11 September 2026. The security advisory notes a CVSS v3 base score of 9.9 (Critical) and identifies the affected releases as 16.0.0 and any version prior to 15.0.8. There is currently no confirmed exploitation in the wild, and no public PoC exploit is reported. Administrators running self-hosted Forgejo instances are urged to upgrade immediately to 16.0.4 or 15.0.8 to mitigate the risk.

The vulnerability stems from how Forgejo handles repository templates during initialization. When generating a new repository from a template, Forgejo clones the template, removes the .git folder, and performs variable template expansion on files listed in .forgejo/template prior to creating a new Git repository.

The flaw lies in the variable expansion step, which can be manipulated so that the Git folder is recreated and arbitrary data can be read from the host or arbitrary processes executed, enabling a remote code execution attack without requiring special host privileges. Attackers would supply crafted template variables that Git processes during project setup.

Mitigation is straightforward: update to 16.0.4 or 15.0.8 immediately. The fix removes any recreated Git directory before repository initialisation completes. In the interim, administrators should restrict repository creation permissions to trusted users.