Forgejo Template Expansion Flaw Allows Remote Code Execution
Forgejo before 16.0.4 allows remote code execution via a crafted template repository due to mishandled expansion of .forgejo/template files. CVSS 9.9 critical.
- Vendor
- Forgejo
- Product
- Forgejo
- CVSS
- 9.9
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-89094 is a remote code execution vulnerability in Forgejo, a community-maintained fork of the Gitea self-hosted Git service.
The flaw affects Forgejo prior to version 16.0.4. When a repository is created from a template, Forgejo processes files under .forgejo/template through a template expansion step. Mishandling in that expansion allows an attacker to achieve code execution on the Forgejo server via a crafted template repository.
The fix is Forgejo 16.0.4, tracked at the 16.0.4 milestone on Codeberg. All Forgejo versions prior to 16.0.4 are affected. No workaround is documented; upgrading is the only remediation.
For news coverage and deployment context, see the related article.
