Forgejo CVE-2025-68937

Exploitation requires the Forgejo template-repository feature to be used: the attacker must control or supply a template repository containing symlinks whose destinations point OUTSIDE the repository tree, and a repository-generation operation from that template must occur. Limiting factors: the attack is high-complexity (CVSS AC:H) and depends on a specific precondition being met (AT:P), and realistically an attacker needs the ability to create/host a template repository, which on typical deployments means an authenticated account (contradicting the vector's PR:N unless the instance permits open registration or anonymous template hosting). Instances on patched versions (13.0.2+, or 11.0.7+ for the 11 LTS line) are not affected.

The official CVSS 4.0 base score of 9.5 (Critical) is driven by high impact to both the vulnerable system and subsequent systems (VC/VI/VA:H and SC/SI/SA:H), reflecting that arbitrary file write via symlink following (CWE-61) can escalate to server shell access. However, two signals temper real-world urgency: AC:H (high attack complexity) and AT:P (a specific precondition must exist/win), meaning exploitation is not trivial or reliably repeatable. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or widespread exploitation - this reads as a serious-but-not-yet-exploited issue rather than an emergency. A notable discrepancy: the CVSS vector asserts PR:N (unauthenticated), yet the vulnerability hinges on an attacker supplying a malicious TEMPLATE repository containing out-of-repository symlinks, which on most Forgejo deployments requires an authenticated account to create/host - verify whether anonymous or open-registration instances truly allow PR:N exploitation. Also note the input Tag 'Information Disclosure' contradicts the actual vulnerability class (arbitrary file WRITE / potential RCE), which could mislead triage.

An attacker crafts a template repository whose files include symlinks pointing to destinations outside the repository tree (e.g., system paths or the Forgejo working directory). When a victim or the server instantiates a new repository from this template, Forgejo follows the symlink and writes attacker-influenced content to unintended locations, potentially planting a file that yields server shell access. No public exploit code was identified at time of analysis, and the AC:H/AT:P metrics indicate the attacker must satisfy specific conditions for the write to land successfully.