Forgejo 16.0.4 and 15.0.8 address critical security vulnerability
The Forgejo software-forge project has announced the release of versions 16.0.4 and 15.0.8 , which fixes two security vulnerabilities. One is a critical flaw that would allow remote-code execution (RCE): When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in…
Forgejo has released versions 16.0.4 and 15.0.8 to patch two security vulnerabilities. One is a critical flaw that enables remote-code execution (RCE). When creating a new repository from a template, Forgejo clones the template, removes the .git folder, expands template variables, and initializes a new git repository. Misuse of variable expansion could create a new .git folder, allowing a malicious template to read data or execute processes on the Forgejo host.
To fix this, Forgejo now removes any existing .git folder before initializing the git repository. Users are urged to upgrade immediately for protection.
Written by urgent.news from LWN's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
