Forgejo EUVD-2026-113811

Exploitation requires (1) an attacker to supply a crafted repository dump whose release.yml has a DownloadURL or PatchURL field containing ../ traversal sequences, and (2) an administrator to run the restore-repo CLI command against that malicious dump (passive interaction, UI:P; local operation, AV:L). Limiting factors: this is not remotely or network-triggerable and requires no attacker privileges on the instance, but it does require an administrator to be induced to restore an untrusted/attacker-supplied dump - a social-engineering or supply-of-dump precondition that substantially narrows real-world exploitability. Files read are limited to those readable by the Forgejo process, and impact is disclosure only (no write/integrity or availability effect).

This is a medium-severity information-disclosure flaw (CVSS 4.0 6.8). The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) is internally consistent with the description: exploitation is local to the restore-repo CLI workflow (AV:L) and requires passive administrator interaction (UI:P) - an admin must choose to restore an attacker-supplied dump - while the attacker needs no privileges on the Forgejo instance itself (PR:N). Impact is confidentiality-only (VC:H, VI:N, VA:N), consistent with reading files such as app.ini (which can expose secrets/tokens). On the decision signals: there is NO CISA KEV listing and NO EPSS score in the provided data, and the vuln.today priority label is 'this_month' (not act_now/emergency), so this is a patch-on-normal-cycle issue rather than an emergency. It is a genuine but bounded risk: real impact (local file disclosure of potentially sensitive config) tempered by a constrained threat model (requires tricking an administrator into restoring a malicious dump). NOTE a cross-source discrepancy: the GHSA advisory included in the input (GHSA-xmj7-xj85-hfc3) describes a DIFFERENT vulnerability - an SSRF (CWE-918) via unsanitized pull_request.yml Head.CloneURL - which the advisory itself states is a separate root cause from this path-traversal issue (fixed in PR #38215); do not treat the SSRF's details as part of this CVE.

An attacker crafts a repository dump whose release.yml contains a DownloadURL or PatchURL with ../ sequences (e.g. ../../../../etc/passwd or a path to app.ini) and gets an administrator to restore it via restore-repo. When restored, the traversal causes files outside the dump directory to be imported as release attachments, disclosing their contents. A technical write-up and a regression test demonstrating the traversal are publicly referenced, though no verified working weaponized exploit is confirmed in the input.