Forgejo Patches CVSS 9.9 Template RCE in 16.0.4

Template repositories in Forgejo are a routine infrastructure feature: mark a repository as a template, and other users can spin up new repos from it, with files in the .forgejo/template directory expanded during that process. In versions before 16.0.4, that expansion step contains a flaw that allows remote code execution.

CVE-2026-89094 carries a CVSS score of 9.9 critical. The fix is in Forgejo 16.0.4. There is no documented workaround; the patch is the fix.

What the flaw does

Files under .forgejo/template are processed during repository creation from a template. CVE-2026-89094 is a vulnerability in how Forgejo handles that expansion. A crafted template repository can trigger remote code execution on the Forgejo server during that processing step.

The Forgejo advisory does not describe a specific authentication prerequisite beyond what the CVSS score reflects. The score of 9.9 rather than the maximum 10.0 typically indicates a narrow constraint in the attack path; the practical consequence on a network-accessible instance is full server process compromise.

Why self-hosted Git servers draw active attention

Forgejo is a community-maintained fork of Gitea. The two share most of their codebase history, and both appeal to organizations that want a self-hosted Git alternative without enterprise licensing overhead.

Self-hosted forges accumulate the kind of material that makes them worth targeting: source code, CI/CD pipeline secrets, deployment tokens, and SSH keys often stored directly in repository settings. Server-level code execution gives an attacker access to all of it.

The pattern is not hypothetical. Gitea’s own CVSS 9.9 RCE, fixed in Gitea 1.27.1 and later confirmed exploited, reached CISA’s Known Exploited Vulnerabilities catalog last month. That active exploitation campaign dropped cryptominers on exposed instances within weeks of disclosure. The window between patch and active exploitation on self-hosted Git infrastructure has been consistently short this year.

What to do

Upgrade to Forgejo 16.0.4. The release is tracked at the 16.0.4 milestone on Codeberg. Check your current version from the administration panel or with forgejo --version, and follow the standard upgrade path for your deployment method.

If your instance is internet-accessible, this is a patch-now situation. Restricting template creation to trusted users reduces who can initiate the vulnerable code path, but that operational control does not close the underlying flaw. The patch does.

For full CVE details and affected version range, see CVE-2026-89094.