CVE-2026-89094 PUBLISHED

Assigner: mitre
Reserved: 10.09.2026 Published: 10.09.2026 Updated: 10.09.2026

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Forgejo
Product	Forgejo
Versions	Default: unaffected affected from 16.0.0 to 16.0.4 (excl.) affected from 0 to 15.0.8 (excl.)

References

https://news.ycombinator.com/item?id=49645907
https://codeberg.org/forgejo/forgejo/milestone/139655

Problem Types

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CWE