CVE-2026-890949.9CriticalCWE-1336
Forgejo vulnerability
Not in CISA KEVFixed in version 16.0.4
0.8%probability of exploitation in the next 30 days
57th percentile
050100
Higher than 57% of scored CVEs
9.9CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 11 Sep.
- Forgejo Fixes Critical Flaw Allowing Remote Code Execution via TemplatesSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.