Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)
Forgejo has released versions 16.0.4 and 15.0.8 to patch two security vulnerabilities. One is a critical flaw that enables remote-code execution (RCE). When creating a new repository from a template, Forgejo clones the template, removes the .git folder, expands template variables, and initializes a new git repository. Misuse of variable expansion could create a new .git folder, allowing a malicious template to read data or execute processes on the Forgejo host.
To fix this, Forgejo now removes any existing .git folder before initializing the git repository. Users are urged to upgrade immediately for protection.
Written by urgent.news from LWN's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
