CVE-2026-89094

Forgejo before 16.0.4 mishandles the expansion of template files stored under .forgejo/template, a template-injection flaw (CWE-1336) that can be abused for remote code execution. An attacker needs a low-privileged account on the instance (CVSS PR:L) and a crafted template repository; the flaw is triggered when the Forgejo server performs template expansion on those files, such as when a new repository is instantiated from the crafted template. Because the CVSS scope is changed with high confidentiality, integrity, and availability impacts, successful exploitation yields code execution in the server's context, effectively compromising the entire forge instance rather than a single repository. Anyone running a self-hosted Forgejo instance on an affected version, particularly one that allows users to create or instantiate template repositories, is exposed. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and the issue is fixed in Forgejo 16.0.4.

What to do: Upgrade Forgejo to 16.0.4 or later. Until patched, restrict which accounts may create or mark repositories as templates and review existing repositories' .forgejo/template contents for unexpected files, and avoid instantiating new repositories from templates you did not create. Note that exploitation requires an account on the instance, so closing registration or limiting untrusted users also reduces risk.