CRITICAL 9.9 NVD

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

References

Published: 2026-09-10 · Source: NVD · Feed updated: 2026-09-12
This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-09-10 via NVD.

Risk Timeline

CVE Disclosed2026-09-10 · 1 day ago

Remediation Resources

Analysis & PoC
codeberg.org/forgejo/forgejo/milestone/139655
Analysis & PoC
news.ycombinator.com/item?id=49645907
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.