Paper/Archive/CVE-2026-89094

CVE-2026-89094

Forgejo Forgejo — Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/temp…

EPSS 0.9%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 58.2.582 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Affected

ProductAffectedFixed inSource

Forgejo16.0.0 – < 16.0.416.0.4CNA

Forgejo< 15.0.815.0.8CNA

Scores by source

mitre (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refnews.ycombinator.com/item?id=49645907 refcodeberg.org/forgejo/forgejo/milestone/139655