CVE-2026-89094 Forgejo Remote Code Execution Hits CVSS 9.9

Forgejo developers released version 16.0.4 on September 11, 2026, to address a critical flaw. This severe bug enables a Forgejo remote code execution attack through malicious template repositories. Consequently, administrators must upgrade their self-hosted Git instances immediately to protect their development servers.

Why This Threat Matters

Industry estimates suggest that thousands of development teams run self-hosted Forgejo instances to maintain private code repositories. Therefore, a server compromise creates substantial security risks for continuous integration pipelines. Threat actors who breach the host can steal proprietary source code and extract private credentials. Furthermore, attackers can tamper with project builds to compromise downstream software releases.

How the Attack Works

The vulnerability stems from improper handling of repository templates during initialization. According to the release notes, “When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository.”

However, the variable expansion process allows attackers to recreate the Git folder. The advisory notes, “A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack.” Attackers supply crafted template variables that Git incorporates during project setup. This flaw enables unauthorized Forgejo remote code execution without requiring special host privileges.

Affected Versions

This critical flaw impacts all Forgejo releases prior to version 16.0.4. The bug holds a critical CVSS base score of 9.9. Currently, security researchers have confirmed no active exploitation in the wild. Additionally, no public proof-of-concept exploit code exists for this vulnerability.

Patch and Mitigation Steps

Administrators must upgrade their installations to version 16.0.4 or later immediately. The maintainers resolved the issue by removing any recreated Git directory before repository initialization completes. You can review release details and download updates from the Forgejo milestone release page. Meanwhile, teams should restrict repository creation permissions to trusted users until they complete the upgrade.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.