Forgejo CVE-2026-89094

Requires an authenticated account (CVSS PR:L) with the ability to create or instantiate a template repository, and the target Forgejo instance must be running a version before 16.0.4 with the template-repository feature usable. The specific trigger is template expansion of files placed in the .forgejo/template directory; the malicious content is delivered via a crafted template repository. Exploitation is limited by the need for that account and template-creation permission - instances that allow open registration or grant broad repo-creation rights remove this barrier, while instances restricting repo/template creation to trusted users substantially limit exposure. No user interaction by a victim is required (UI:N).

The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, only low privileges required, no user interaction, and a scope change reflecting that template execution escapes into the underlying server/host with full confidentiality, integrity and availability impact. The PR:L rather than PR:N is the key nuance - an attacker needs an account with the ability to create/use a template repository, so this is not fully unauthenticated; on instances that allow open registration, however, PR:L is trivially met. No EPSS score, no CISA KEV listing, and no confirmed public POC were provided, so there is no evidence of active exploitation yet; the risk is driven by the severity of the primitive (server RCE) rather than by observed in-the-wild activity. Because Forgejo instances often hold source code, secrets and CI credentials, any operator running an affected version - even a mid-sized municipal IT team in inowroclaw should treat this as urgent - should prioritize upgrading regardless of the missing exploitation telemetry.

An attacker registers (or already holds) a low-privilege account on a Forgejo instance, creates a template repository containing malicious template directives in a .forgejo/template file, and then generates a new repository from it. When Forgejo expands the template server-side, the injected directives execute as code on the host, giving the attacker command execution in the Forgejo server context. No public exploit code has been identified at time of analysis.