Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-89094: Forgejo before 16.0.4 lets attackers run code via template repo

CVE-2026-89094 · published 1 month ago

Summary

If you use Forgejo version earlier than 16.0.4 and allow template repositories, a specially crafted template can cause the server to execute unwanted code. This could let an attacker take control of the system or steal data. Upgrade Forgejo to version 16.0.4 or later as soon as possible to stop the risk.

What to do

Update forgejo forgejo to version 16.0.4 or later.

Affected software

Vendor	Product	Affected versions
forgejo	forgejo	< 16.0.4

Original advisory text

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-1336Improper Neutralization of Special Elements Used in a Template Engine

Timeline

Published10 Sep 2026

Updated7 Oct 2026

First seen10 Sep 2026

Sources

CVE-2026-89094 · NVD

CVE-2026-89094 · MITRE

Track software like this

Free during beta