{"id":183325,"date":"2026-09-11T22:53:31","date_gmt":"2026-09-11T20:53:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-platforme-sovmestnoj-razrabotki-forgejo-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2026-09-11T22:53:36","modified_gmt":"2026-09-11T20:53:36","slug":"remote-code-execution-vulnerability-in-the-forgejo-collaborative-development-platform","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/remote-code-execution-vulnerability-in-the-forgejo-collaborative-development-platform","title":{"rendered":"Vulnerability in the collaborative development platform Forgejo, allowing remote code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ir veikti labojumi sadarb\u012bbas platformas Forgejo versij\u0101m 16.0.4 un 15.0.8, kuri nov\u0113r\u0161 kritisku ievainojam\u012bbu (CVE nav pie\u0161\u0137irts), kas \u013cauj att\u0101lin\u0101tam uzbruc\u0113jam izpild\u012bt savu kodu server\u012b. Serveru administr\u0101cijai ir ieteikts steidzami atjaunin\u0101t savas sist\u0113mas un p\u0101rliecin\u0101ties par kompromit\u0101cijas sek\u0101m. Ievainojam\u012bba radusies nepietiekamas t\u012br\u012b\u0161anas d\u0113\u013c, veidojot jaunu repozitoriju no veidnes. <\/p>\n

Lai nov\u0113rstu savas komandas ievieto\u0161anu, apstr\u0101d\u0101jot lietot\u0101ja nodoto veidni, platforma izdz\u0113\u0161 apak\u0161direktoriju .git\/ pirms jauna git-repozitorija inicializ\u0113\u0161anas uz serveri<\/a>. Uzbruc\u0113js var\u0113tu apiet \u0161o dz\u0113\u0161anu un izveidot apak\u0161direktoriju .git\/ ar savu saturu, manipul\u0113jot ar main\u012bgo aizvieto\u0161anu failos, kas izvietoti direktorij\u0101 .forgejo\/template (piem\u0113ram, izmantojot aizvieto\u0161anu \u201e.. \/.. \/ .git\/hooks\u201d faila ce\u013c\u0101). P\u0113c tam, kad git repozitorijs tika inicializ\u0113ts, Git piem\u0113roja iestat\u012bjumus no apak\u0161direktorijas .git\/, kas var\u0113ja ietver ar\u012b oper\u0101cijas, kas uzs\u0101ka patva\u013c\u012bgus procesus. Probl\u0113ma ir atrisin\u0101ta, izdz\u0113\u0161ot apak\u0161direktoriju .git\/ nevis pirms main\u012bgo atkl\u0101\u0161anas, bet tie\u0161i pirms \u2018git init\u2019 palai\u0161anas. <\/p>\n

Gitea 1.25.5 tika nov\u0113rsta l\u012bdz\u012bga ievainojam\u012bba (CVE-2026-25718) febru\u0101r\u012b.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Forgejo 16.0.4 \u0438 15.0.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Forgejo \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043e \u0441\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u0441\u044f \u0432 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u0447\u0438\u0441\u0442\u043a\u0438 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438\u0437 \u0448\u0430\u0431\u043b\u043e\u043d\u0430. \u0414\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183325","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba sadarb\u012bbas platform\u0101 Forgejo, kas \u013cauj att\u0101lin\u0101tu koda izpildi | ProHoster","description":"Ir veikti labojumi sadarb\u012bbas platformas Forgejo versij\u0101m 16.0.4 un 15.0.8, kuri nov\u0113r\u0161 kritisku ievainojam\u012bbu (CVE nav pie\u0161\u0137irts), kas \u013cauj att\u0101lin\u0101tam uzbruc\u0113jam izpild\u012bt savu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/remote-code-execution-vulnerability-in-the-forgejo-collaborative-development-platform","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Forgejo, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 Forgejo 16.0.4 \u0438 15.0.8, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/remote-code-execution-vulnerability-in-the-forgejo-collaborative-development-platform","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-11T20:53:31+00:00","article:modified_time":"2026-09-11T20:53:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183325","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-09-22 16:21:01","updated":"2026-09-22 16:21:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=183325"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183325\/revisions"}],"predecessor-version":[{"id":183326,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/183325\/revisions\/183326"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=183325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=183325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=183325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}