Forgejo
Monthly
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 lets an authenticated user with a read:user-scoped API token or an active session retrieve other users' SSH, deploy, and principal key titles, fingerprints, and public key material through the GetPublicKey API. The handler omits an ownership check, so sequential numeric key IDs can be enumerated; this is an authenticated IDOR (CWE-639) rated CVSS 5.3 with confidentiality-only impact and no integrity or availability effect. A public research write-up is referenced, but working exploit code is not confirmed in the provided data, and exploitation requires a valid low-privilege account.
Forgejo's restore-repo CLI can be induced to read files outside the dump directory - including repository configuration such as app.ini - and import them as release attachments when an administrator restores a crafted dump. The flaw affects Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1; exploitation requires local operation of restore-repo and administrator interaction (CVSS 4.0 6.8, confidentiality impact only). Vendor patch availability is reported; the supplied data does not confirm active exploitation or working public exploit code, and a public research write-up is referenced.
Unauthenticated blind server-side request forgery in Forgejo (through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1) lets anyone who can reach the instance POST a crafted OpenID identifier to /user/login/openid and force the server to issue discovery GET requests against loopback, cloud metadata and internal addresses for port scanning and probing. Exposure depends entirely on the OpenID sign-in feature being enabled, which is not the default; where it is enabled no credentials or user interaction are required. The impact is limited to low confidentiality because the requests are blind and responses are not returned to the attacker - the flaw is not in CISA KEV, so no confirmed active exploitation has been reported, although the upstream advisory publishes a proof-of-concept reproduction script.
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub actor and keypair to submit HTTP-Signature-valid activities falsely attributed to arbitrary actor identities on a target instance. Affected versions span 13.0.0 through 16.0.4, but only when federation is explicitly enabled via the non-default setting `[federation] ENABLED = true`. The vendor explicitly confirms this does not permit account takeover or content modification - impact is limited to false attribution of federated activities. No public exploit has been identified at time of analysis.
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authenticated users holding limited-scope tokens to invoke the 'allow maintainer edit' pull-request feature beyond those tokens' intended permissions. The flaw is CWE-863 Incorrect Authorization: the endpoint responsible for toggling maintainer-edit access on PRs fails to enforce token scope boundaries, permitting a scoped token to reach an operation it should be barred from. No public exploit has been identified at time of analysis, and CVSS AC:H signals that specific token configuration conditions must be met to trigger the bypass.
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.
Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers by embedding an HTML payload in their display name and triggering a CI/CD Actions run. The vulnerability exists because the server-side run description assembles HTML by interpolating the user's full name through a translation function that performs no output encoding, and the frontend renders this server-generated markup via a Vue v-html binding - a classic sink for stored XSS. No public exploit identified at time of analysis as actively exploited in the wild, but a public proof-of-concept exists at the VulnCheck-referenced GitHub repository. The CVSS 4.0 score of 2.1 reflects the non-default configuration prerequisite and passive user interaction required, but the impact on subsequent systems (other users' browser sessions) is real.
Forgejo before 13.0.2 (and the 11 LTS line before 11.0.7) mishandles out-of-repository symlink destinations when generating repositories from templates, allowing an attacker who can supply or control a template repository to write files to arbitrary server-side paths and potentially escalate to server shell access. The vendor rates this Critical (CVSS 4.0 base 9.5) because both the vulnerable system and subsequent systems are affected (VC/VI/VA:H, SC/SI/SA:H); our independent assessment concurs on high confidentiality, integrity, and availability impact under CVSS:3.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) but notes the attack is high-complexity, requires a specific precondition (template creation plus a repository-generation step), and realistically requires an authenticated account - the vector's PR:N only holds if the instance allows open registration or anonymous template hosting. No confirmed active exploitation exists (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; instances already on 13.0.2 or 11.0.7+ are not affected.
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run arbitrary code on the server, because template expansion of files under .forgejo/template is mishandled (server-side template injection, CWE-1336). Any user permitted to create repositories from a malicious template can trigger execution in the server context. No public exploit has been identified at time of analysis, but the SSTI root cause and self-hosted Git-forge target make this a high-priority patch.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 lets an authenticated user with a read:user-scoped API token or an active session retrieve other users' SSH, deploy, and principal key titles, fingerprints, and public key material through the GetPublicKey API. The handler omits an ownership check, so sequential numeric key IDs can be enumerated; this is an authenticated IDOR (CWE-639) rated CVSS 5.3 with confidentiality-only impact and no integrity or availability effect. A public research write-up is referenced, but working exploit code is not confirmed in the provided data, and exploitation requires a valid low-privilege account.
Forgejo's restore-repo CLI can be induced to read files outside the dump directory - including repository configuration such as app.ini - and import them as release attachments when an administrator restores a crafted dump. The flaw affects Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1; exploitation requires local operation of restore-repo and administrator interaction (CVSS 4.0 6.8, confidentiality impact only). Vendor patch availability is reported; the supplied data does not confirm active exploitation or working public exploit code, and a public research write-up is referenced.
Unauthenticated blind server-side request forgery in Forgejo (through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1) lets anyone who can reach the instance POST a crafted OpenID identifier to /user/login/openid and force the server to issue discovery GET requests against loopback, cloud metadata and internal addresses for port scanning and probing. Exposure depends entirely on the OpenID sign-in feature being enabled, which is not the default; where it is enabled no credentials or user interaction are required. The impact is limited to low confidentiality because the requests are blind and responses are not returned to the attacker - the flaw is not in CISA KEV, so no confirmed active exploitation has been reported, although the upstream advisory publishes a proof-of-concept reproduction script.
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub actor and keypair to submit HTTP-Signature-valid activities falsely attributed to arbitrary actor identities on a target instance. Affected versions span 13.0.0 through 16.0.4, but only when federation is explicitly enabled via the non-default setting `[federation] ENABLED = true`. The vendor explicitly confirms this does not permit account takeover or content modification - impact is limited to false attribution of federated activities. No public exploit has been identified at time of analysis.
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authenticated users holding limited-scope tokens to invoke the 'allow maintainer edit' pull-request feature beyond those tokens' intended permissions. The flaw is CWE-863 Incorrect Authorization: the endpoint responsible for toggling maintainer-edit access on PRs fails to enforce token scope boundaries, permitting a scoped token to reach an operation it should be barred from. No public exploit has been identified at time of analysis, and CVSS AC:H signals that specific token configuration conditions must be met to trigger the bypass.
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.
Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers by embedding an HTML payload in their display name and triggering a CI/CD Actions run. The vulnerability exists because the server-side run description assembles HTML by interpolating the user's full name through a translation function that performs no output encoding, and the frontend renders this server-generated markup via a Vue v-html binding - a classic sink for stored XSS. No public exploit identified at time of analysis as actively exploited in the wild, but a public proof-of-concept exists at the VulnCheck-referenced GitHub repository. The CVSS 4.0 score of 2.1 reflects the non-default configuration prerequisite and passive user interaction required, but the impact on subsequent systems (other users' browser sessions) is real.
Forgejo before 13.0.2 (and the 11 LTS line before 11.0.7) mishandles out-of-repository symlink destinations when generating repositories from templates, allowing an attacker who can supply or control a template repository to write files to arbitrary server-side paths and potentially escalate to server shell access. The vendor rates this Critical (CVSS 4.0 base 9.5) because both the vulnerable system and subsequent systems are affected (VC/VI/VA:H, SC/SI/SA:H); our independent assessment concurs on high confidentiality, integrity, and availability impact under CVSS:3.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) but notes the attack is high-complexity, requires a specific precondition (template creation plus a repository-generation step), and realistically requires an authenticated account - the vector's PR:N only holds if the instance allows open registration or anonymous template hosting. No confirmed active exploitation exists (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; instances already on 13.0.2 or 11.0.7+ are not affected.
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.