News › security
By Zayden R., September 11, 2026
Forgejo has released versions 16.0.4 and 15.0.8 to fix a critical security flaw allowing remote code execution. Engineers should upgrade immediately to protect their systems.
The Forgejo project has announced the release of versions 16.0.4 and 15.0.8, addressing a critical security vulnerability that could allow remote code execution. This flaw, discovered in the way Forgejo handles repository templates, is serious enough that engineers are advised to upgrade their installations without delay.
The vulnerability arises during the creation of a new repository from a template. Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in the .forgejo/template, and initializes a new git repository. However, during this process, there was a potential for misuse in the variable template expansion phase. A malicious template could create a new .git folder, which would be adopted by git during initialization, potentially allowing attackers to read arbitrary data or execute arbitrary processes on the Forgejo host.
To mitigate this risk, Forgejo has now implemented a fix where any existing .git folder is removed from the directory after variable expansion, but before the git repository is initialized. This ensures that the vulnerability cannot be exploited through template repositories.
For engineers using Forgejo, upgrading to the latest version is critical to maintaining the security of their systems. The update process should be straightforward, and the project has provided SHA256 checksums for verification of the downloads. The urgency of this update cannot be overstated, given the potential severity of the exploit in question.
In practice, this release underscores the importance of keeping software forges up to date, particularly those handling sensitive or critical code repositories. As always, vigilance and timely updates are key in safeguarding against potential security threats.