Overview
A critical remote code execution vulnerability has been disclosed in Forgejo, the self-hosted Git service forked from Gitea. Tracked as CVE-2026-89094, the flaw carries a CVSS score of 9.9 (Critical) and stems from improper neutralization of special elements during template repository expansion (CWE-1336).
Forgejo versions before 16.0.4 are affected, alongside upstream Gitea versions carrying the same unpatched template-handling logic.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-89094 |
| Severity | Critical (CVSS 9.9) |
| Attack Vector | Network |
| Authentication | Low Privileges Required |
| User Interaction | None |
| Impact | RCE as the Forgejo service user |
How It Works
Forgejo supports template repositories, which let administrators or users pre-configure a repository structure that other users can clone as the starting point for a new project. When a new repository is created from a template, Forgejo processes files under .forgejo/template to populate the target repository's working tree.
CVE-2026-89094 exists because Forgejo fails to adequately sanitize file names and content within .forgejo/template before expanding them into the new repository. An attacker who controls a template repository — which typically only requires a low-privileged authenticated account — can craft malicious template content that gets written outside the intended working tree when a victim creates a repository from it.
Related research (published alongside the CVE by security researcher ClemaX) demonstrated that, knowing the default path of the Git service account's home directory (/data/git in the official Docker image), an attacker can use template expansion to write into .ssh/authorized_keys for that account — injecting an SSH key that grants direct shell access, without any command restriction. Beyond SSH key injection, the same primitive can be used to corrupt configuration files or the SQLite database, or to read arbitrarily large files off the host as a denial-of-service vector.
Affected version ranges per the referenced research: Gitea v1.11.0-rc1 through v1.24.6, and Forgejo ≤ v11.0.6 as well as v12.0.0 through v13.0.1. Forgejo 16.0.4 contains the fix.
Impact Assessment
Who Is At Risk
- Self-hosted Forgejo (or Gitea) instances that allow authenticated users to create or use template repositories
- Multi-tenant Forgejo forge deployments where any registered user — not just administrators — can create repositories from templates supplied by other users
- Instances where the Git service account's home directory is predictable (the default in most container-based deployments)
Potential Attack Chains
- Malicious Template Creation — A low-privileged authenticated attacker creates a repository configured as a template, embedding crafted content in
.forgejo/template - Victim or Self-Triggered Expansion — A repository is created from the malicious template (by the attacker or a lured victim), triggering unsanitized template expansion
- Filesystem Write Outside the Working Tree — Crafted paths escape the intended repository directory
- RCE via SSH Key Injection — Writing to the Git user's
authorized_keysgrants the attacker an interactive shell or arbitrary command execution as the Forgejo service account
Mitigation
Immediate Actions
- Upgrade to Forgejo 16.0.4 or later immediately — this is a low-complexity, high-impact flaw with public research detailing exploitation
- Restrict who can create or mark repositories as templates, where organizational policy allows
- Review recently created repositories for unexpected content under
.forgejo/template - Check the Git service account's
authorized_keysfile for unauthorized entries
Detection Opportunities
- Repository creation events sourced from template repositories owned by untrusted or unfamiliar accounts
- Unexpected modifications to
~/.ssh/authorized_keys, configuration files, or the SQLite database for the Git service account - Anomalous file read patterns consistent with the described DoS variant (reading unusually large files during template expansion)
Defence-in-Depth
- Run the Forgejo/Git service account with a non-predictable home directory path where feasible
- Apply filesystem permissions that prevent the service process from writing outside its designated data directory
- Monitor SSH authentication logs for the Git service account for unexpected key-based logins
Background: Forgejo and Gitea as Targets
Forgejo and Gitea power a large share of self-hosted Git infrastructure for organizations avoiding centralized platforms like GitHub or GitLab. A critical, low-complexity RCE in core repository-creation functionality — reachable by any low-privileged user — makes this an urgent patch priority, particularly for forges that allow open or semi-open registration.