{
  "id": 6632069,
  "title": "Forgejo 16.0.4 and 15.0.8 address critical security vulnerability",
  "url": "https://urgent.news/2026/09/10/forgejo-16-0-4-and-15-0-8-address-critical-security-vulnerability",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-10T20:05:50.000Z",
  "source": {
    "name": "LWN",
    "slug": "lwn",
    "url": "https://lwn.net/Articles/1093671/"
  },
  "original_language": "en",
  "account": "Forgejo has released versions 16.0.4 and 15.0.8 to patch two security vulnerabilities. One is a critical flaw that enables remote-code execution (RCE). When creating a new repository from a template, Forgejo clones the template, removes the .git folder, expands template variables, and initializes a new git repository. Misuse of variable expansion could create a new .git folder, allowing a malicious template to read data or execute processes on the Forgejo host. To fix this, Forgejo now removes any existing .git folder before initializing the git repository. Users are urged to upgrade immediately for protection.",
  "summary": "The Forgejo software-forge project has announced the release of versions 16.0.4 and 15.0.8 , which fixes two security vulnerabilities. One is a critical flaw that would allow remote-code execution (RCE): When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in…",
  "key_points": [
    "Forgejo releases 16.0.4 and 15.0.8 to patch critical security vulnerabilities",
    "Critical flaw allows remote-code execution (RCE) via template variable expansion",
    "Users advised to upgrade immediately for protection"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Lobsters",
        "title": "Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)",
        "url": "https://urgent.news/2026/09/10/forgejo-16-0-4-has-a-critical-security-bug-fix-rce-remote-code",
        "published": "2026-09-10T17:40:19.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}