Patching releases of the Forgejo collaborative development platform, versions 16.0.4 and 15.0.8, have been published. These patches address a critical vulnerability (CVE not assigned) that could allow a remote attacker to execute code on the server. Forgejo server administrators are advised to immediately update their systems and ensure there are no traces of compromise. The vulnerability is caused by a lack of proper cleanup when creating a new repository from a template.
To prevent substitution of its commands when processing a user-supplied template, the platform removes the .git/ subdirectory from it before initializing a new git repository on serverAn attacker could bypass this deletion and create a .git/ subdirectory containing its own contents by manipulating variable substitution in files located in the .forgejo/template directory (for example, by substituting "../../.git/hooks" into the file path). Upon subsequent Git repository initialization, Git would apply settings from the .git/ subdirectory, which could include operations that launch arbitrary processes. This issue was resolved by deleting the .git/ subdirectory immediately before running "git init," rather than before variable expansion.
In Gitea 1.25.5, a similar vulnerability (CVE-2026-25718) was fixed in February.
Source: opennet.ru
