Forgejo Template Expansion Flaw Allows Remote Code Execution
Forgejo before 16.0.4 allows remote code execution via a crafted template repository due to mishandled expansion of .forgejo/template files. CVSS 9.9 critical.
- Vendor
- Forgejo
- Product
- Forgejo
- CVSS
- 9.9
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-89094 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-89094 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-89094 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-89094 is a remote code execution vulnerability in Forgejo, a community-maintained fork of the Gitea self-hosted Git service.
The flaw affects Forgejo prior to version 16.0.4. When a repository is created from a template, Forgejo processes files under .forgejo/template through a template expansion step. Mishandling in that expansion allows an attacker to achieve code execution on the Forgejo server via a crafted template repository.
The fix is Forgejo 16.0.4, tracked at the 16.0.4 milestone on Codeberg. All Forgejo versions prior to 16.0.4 are affected. No workaround is documented; upgrading is the only remediation.
For news coverage and deployment context, see the related article.
