By ByteBot
Forgejo pushed emergency security patches on September 10 — versions 16.0.4 and 15.0.8 — fixing CVE-2026-89094, a CVSS 9.9 remote code execution flaw in the repository-from-template feature. Any authenticated user with low privileges can exploit this to run arbitrary commands on your Forgejo host. If your instance hasn’t been patched, it’s not a matter of if you’re at risk — it’s a matter of who has an account.
Who Is Affected and What to Patch
Every Forgejo instance running version 16.0.3 or older is vulnerable. If you’re on the LTS branch, 15.0.7 and older are also affected. Forgejo 16.0.4 and 15.0.8 are the patched releases, both available as of September 10. Check your version at /api/v1/version on your instance — the JSON response includes the current Forgejo version.
Critically, Gitea is also in scope. Forgejo is a fork of Gitea and both share the vulnerable template expansion code. Gitea 1.25.4 and older carry the same flaw; Gitea 1.25.5 patches it. The Forgejo 16.0.4 release closed 23 issues in total, including an API token authorization flaw and a draft release attachment exposure fix — worthwhile upgrades on their own merits.
How CVE-2026-89094 Works
Repository creation from a template follows four steps: clone the template, delete the .git folder, expand variables in files listed under .forgejo/template, then run git init. The vulnerability lives in the transition between steps three and four. Variable expansion can be crafted to recreate a .git directory — complete with a hooks/ subdirectory containing executable scripts. When git init runs, it discovers the pre-existing .git folder and adopts it, executing those hooks with the privileges of the Forgejo service account.
The flaw is classified as CVE-2026-89094 (CWE-1336 — Improper Neutralization of Special Elements in a Template Engine) with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The “S:C” — Scope Changed — means execution escapes the Forgejo process boundary. The patch removes any recreated .git folder after expansion completes, before git init runs. Developers in the Hacker News discussion correctly noted this is a symptom fix — sandboxing the template expansion into a restricted environment would address the underlying class of bugs. However, it does block this specific attack vector.
Moreover, if you created repositories from templates recently, audit their .git/hooks/ directories. Any executable files there that you didn’t place deliberately should be treated as a compromise indicator.
Open Registration Is Highest Risk — But Closed Instances Are Not Safe
The CVSS “PR:L” (Low Privileges Required) designation is the key number to internalize. This is not a bug that requires an admin account or a special role. Any user account with repository creation permissions is sufficient to exploit it. For instances with open registration, that means any person on the internet who creates a free account can chain this into host-level code execution. The developer reaction on Hacker News was direct: “If you have open registrations…they could potentially exploit this and you probably wanna upgrade ASAP.”
Closed instances aren’t off the hook. Compromised developer credentials, contractors with temporary access, or CI service accounts with repository creation permissions all represent viable attack paths. The S:C scope change means the blast radius extends beyond the git service itself — if Forgejo runs on a shared host alongside other services, those services are in scope too.
For context on why this matters right now: three weeks ago, Gitea CVE-2026-60004 landed on CISA’s Known Exploited Vulnerabilities catalog, confirmed deploying cryptominer payloads on over 8,300 exposed servers. Attackers are actively scanning self-hosted git infrastructure. Self-hosted git is not a safe-by-obscurity corner of your stack anymore — treat it with the same patch urgency as your web servers. The LWN.net security disclosure reflects the severity of this finding.
Key Takeaways
- Upgrade to Forgejo 16.0.4 (or 15.0.8 on LTS) immediately — patches shipped September 10
- Gitea users: upgrade to Gitea 1.25.5 — the same template expansion vulnerability exists in the shared codebase
- Audit
.git/hooks/in any repositories created from templates — executable hook files you didn’t place are a red flag - Ensure Forgejo runs as a non-root service account — privilege containment limits the blast radius of any service-level RCE
- Self-hosted git infrastructure deserves the same patch urgency as production web servers — two CVSS 9+ RCEs in three weeks makes the case
