CVE-2026-89094 in Forgejo
Summary
by MITRE • 09/10/2026
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified as CVE-2025-3897 represents a critical security flaw within Forgejo, an open-source fork of Gitea that provides self-hosted Git service functionality. This issue specifically affects versions prior to 16.0.4 and centers on the mechanism used for expanding template repositories. Template repositories are designed to serve as blueprints for new projects, allowing administrators or users to pre-configure repository structures with specific files, configurations, and directory layouts. When a user creates a new repository from such a template, Forgejo processes the contents of the .forgejo/template directory to populate the new instance. The core technical flaw lies in how these templates are expanded onto the file system during this initialization process.
The fundamental nature of this vulnerability is an improper neutralization of special elements used in commands or paths, which aligns with CWE-78, commonly known as OS Command Injection, and potentially CWE-22, Improper Limitation of a Pathname to a Restricted Directory, if the exploitation involves path traversal. During the template expansion phase, the software fails to adequately sanitize or validate file names and content within the .forgejo/template directory before writing them to the target repository's working tree. This lack of rigorous input validation allows an attacker who has control over the contents of a template repository to inject malicious payloads directly into the execution context of the Forgejo server process. By crafting specific filenames or embedding executable code in files that are processed during expansion, an adversary can manipulate how the system handles these inputs.
The operational impact of this vulnerability is severe, resulting in Remote Code Execution (RCE) with the privileges of the user account running the Forgejo service. In typical deployments, this service runs under a dedicated low-privilege user such as git or forgejo; however, if misconfigured to run with higher system privileges or if other local privilege escalation vectors are present on the host machine, an attacker can achieve full control over the underlying operating system. This capability allows for complete compromise of the server hosting Forgejo, including access to sensitive data stored in repositories, manipulation of database contents, and potential pivoting into internal network segments depending on the deployment architecture. The attack vector is remote because it requires only interaction with the web interface or API endpoints related to repository creation using a malicious template, without needing prior authentication if public templates are accessible, though often authenticated access is required for private template management.
This vulnerability maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically sub-techniques involving shell commands or system scripts depending on the payload used by the attacker. It also relates to T1195, Supply Chain Compromise, if an attacker compromises a template repository that is widely adopted by other organizations using Forgejo, thereby achieving widespread impact through a trusted source. The exploitation relies on the trust placed in template repositories as safe sources for new project initialization, exploiting this implicit assumption of integrity and safety within the application logic.
Mitigation strategies must prioritize immediate software updates to version 16.0.4 or later, where the developers have addressed the mishandling of file expansion processes by implementing stricter validation rules for filenames and content types during template processing. Administrators should also enforce strict access controls on who can create or modify template repositories within their Forgejo instances to prevent unauthorized parties from injecting malicious templates into shared environments. Additionally, running the Forgejo service with minimal necessary privileges using principles of least privilege can limit the potential damage even if an exploitation attempt succeeds. Regular auditing of installed packages and monitoring for unusual process executions originating from the forgejo user account are recommended defensive measures while ensuring that all infrastructure components remain patched against known vulnerabilities in their dependency chains.