Description

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-10T21:17:53.160Z",
  "pubdate": "2026-09-10T21:17:53.160Z",
  "executiveSummary": "A critical remote code execution (RCE) vulnerability exists in Forgejo versions prior to 16.0.4. The vulnerability arises from insecure handling of template expansion within the repository structure.\nSpecifically, the system fails to properly sanitize or restrict files processed during the expansion of template repositories located within the .forgejo/template directory.\nAn unauthenticated or authenticated attacker capable of creating or influencing a template repository can inject malicious content that is subsequently executed by the server during the instantiation process.\nThe impact of this vulnerability is total system compromise, as successful exploitation allows arbitrary code execution with the privileges of the Forgejo application user.\nThis represents a severe risk to confidentiality, integrity, and availability, as attackers can exfiltrate sensitive data, modify repository contents, or pivot into the underlying server infrastructure.\nExploitation requires the attacker to have the ability to commit files to a repository that is utilized as a template, making instances that allow public repository creation or template usage particularly susceptible.",
  "technicalDetails": "The root cause of this vulnerability is improper validation and sanitization of files located within the .forgejo/template directory of a repository designated as a template. When a user creates a new repository based on such a template, Forgejo attempts to expand the template files, dynamically processing them to substitute variables or render content.\nThe vulnerability occurs because the template expansion mechanism does not sufficiently constrain which files are processed or how those files are interpreted. By crafting a repository containing specifically structured files within the .forgejo/template path, an attacker can trigger the template engine to execute arbitrary commands on the host operating system.\nThe attack flow begins when an attacker creates a repository or gains write access to an existing one that is configured to function as a template. The attacker then injects a malicious payload into a file residing in .forgejo/template. When a victim or an automated process triggers the instantiation of this template, Forgejo's internal template engine parses the malicious file.\nDue to the failure in the sanitization logic, the engine treats the attacker-supplied input as executable code or template directives that lead to command injection. This allows the payload to be executed in the context of the Forgejo service account. Because this process occurs server-side, it bypasses client-side security controls.\nThis vulnerability affects all Forgejo versions prior to 16.0.4. The exploitation does not require advanced post-exploitation obfuscation if the environment allows the execution of arbitrary commands, facilitating rapid escalation. The technical impact includes, but is not limited to, the ability to read configuration files, access private keys, inject malicious code into other repositories, or establish persistent backdoors on the server hosting the Forgejo instance.\nExposure is primarily network-based, as the attack vector requires interaction with the Forgejo web interface or API to initiate the repository creation or templating process. Depending on the instance configuration, this may be accessible to any authenticated user or, in some cases, unauthenticated users if repository creation is globally enabled."
}