Executive brief
Forgejo is a self-hosted Git platform used to manage source code repositories. When creating a new repository from a template repository, a flaw in template file processing allows an attacker to execute arbitrary code and read sensitive data from the server. Users who can create repositories from templates (a common default permission) can exploit this to compromise the entire Forgejo instance.
Technical details
The vulnerability exists in Forgejo's template repository initialization process. When cloning a template repository, the system performs variable template expansion on files in .forgejo/template but fails to prevent the creation of a malicious .git folder during expansion. An attacker can craft a template repository containing template files that, when expanded, create a .git folder with arbitrary Git hooks. When Forgejo subsequently initializes the new Git repository, it adopts the attacker-controlled .git folder, allowing arbitrary code execution through Git hooks. The attack requires the ability to create a repository from a template, which is typically available to any authenticated user. The fix removes any .git folder present after template expansion and before repository initialization.
Affected products
- Forgejo Forgejo before 16.0.4
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fix included in Forgejo 16.0.4