Is CVE-2026-119546 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119546 being exploited in the wild.

How severe is CVE-2026-119546?

Medium severity, with a CVSS score of 5.5, published 30 October 2026.

Which products and versions are affected?

Forgejo through 15.0.11, 16.0.0 through 16.0.7, 17.0.0 through 17.0.1.

How is CVE-2026-119546 attacked?

It is attacked with local access.

Am I affected by CVE-2026-119546?

Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119546: Forgejo path traversal in restore-repo

CVE-2026-119546 · Severity: medium · CVSS 5.5 · Published 2026-10-30

Forgejo, a self-hosted Git repository management system, contains a path traversal vulnerability in its restore-repo feature that allows an attacker to read sensitive files from the server. An administrator restoring a malicious backup dump could unknowingly import arbitrary files from the system (such as configuration files containing secrets) as release attachments, exposing confidential data like database credentials or authentication tokens.

Technologies: Forgejo. Vendors: Forgejo.

Quick answers

Is CVE-2026-119546 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119546 being exploited in the wild.
How severe is CVE-2026-119546?: Medium severity, with a CVSS score of 5.5, published 30 October 2026.
Which products and versions are affected?: Forgejo through 15.0.11, 16.0.0 through 16.0.7, 17.0.0 through 17.0.1.
Is there a fix for CVE-2026-119546?: Yes: fixed in Versions after 15.0.11, 16.0.8, and 17.0.2. Until then: Restrict access to the restore-repo command and only restore repository dumps from trusted sources. Do not restore dumps from untrusted users or operators. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119546 attacked?: It is attacked with local access.
Am I affected by CVE-2026-119546?: Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Versions after 15.0.11, 16.0.8, and 17.0.2

Restrict access to the restore-repo command and only restore repository dumps from trusted sources. Do not restore dumps from untrusted users or operators.

Technical details

The vulnerability exists in the restore-repo function which rewrites release asset URLs using filepath.Join and prefixes them with file://, but fails to properly constrain paths when relative traversal sequences (../) are used in the release.yml DownloadURL or PatchURL fields. When uri.Open processes the file:// URL, it calls os.Open on the unsanitized path, allowing directory traversal outside the dump directory. The attack requires local operator interaction to run the restore-repo command on an untrusted dump.

Affected products

Forgejo Forgejo through 15.0.11, 16.0.0 through 16.0.7, 17.0.0 through 17.0.1

Timeline

2026-10-30: disclosed: Published on NVD
2026-10-12: other: 0-day analysis published by Abraxas Labs

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.