What is the CVSS score of CVE-2026-89094?

CVE-2026-89094 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Forgejo are affected by CVE-2026-89094?

Forgejo versions before 16.0.4 contain a critical server-side template injection vulnerability enabling authenticated users with repository creation permissions to execute arbitrary code on…. A patch is available.

How to fix or mitigate CVE-2026-89094?

Within 24 hours, inventory all Forgejo deployments and document current versions. If running versions prior to 16.0.4, immediately restrict template repository creation to administrators only or disable template functionality entirely, and audit all repository creation logs for the past 30 days to identify suspicious template-based repository creation. Within 7 days, monitor the Forgejo project security advisories and GitHub releases for version 16.0.4 availability; when released, plan and schedule patching with mandatory testing in a staging environment using production-like configurations. Within 30 days, deploy the vendor-released patch to all affected Forgejo instances, conduct forensic analysis of all repositories created from templates during the vulnerability exposure period to detect potential compromise indicators, and re-enable template features only after patch deployment with additional role-based access controls limiting template repository creation.

Forgejo CVE-2026-89094

EUVD-2026-75732 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-09-10 mitre

GHSA-q873-4w8p-m645

RCE Ssti Forgejo

9.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable SSTI needs a low-privilege account able to create a template repo (PR:L), no victim interaction, and server RCE that escapes template scope to the host (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 10, 2026 - 22:03 EUVD

Analysis Generated

Sep 10, 2026 - 21:20 vuln.today

CVE Published

Sep 10, 2026 - 20:42 cve.org

CRITICAL 9.9

DescriptionCVE.org

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

AnalysisAI

Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated account (CVSS PR:L) with the ability to create or instantiate a template repository, and the target Forgejo instance must be running a version before 16.0.4 with the template-repository feature usable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, only low privileges required, no user interaction, and a scope change reflecting that template execution escapes into the underlying server/host with full confidentiality, integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Forgejo 16.0.4 or later (Vendor-released patch: 16.0.4), per the milestone at https://codeberg.org/forgejo/forgejo/milestone/139655. … Detailed patch versions, workarounds, and compensating controls in full report.