A critical remote code execution vulnerability in Forgejo allows authenticated attackers to compromise the integrity and availability of the hosting environment.

The flaw, categorized as CWE-1336, involves improper neutralization of special elements used in a template engine. An authenticated attacker can trigger remote code execution by providing a crafted template repository, which the application then mishandles during expansion.

This vulnerability poses a severe risk to organizational infrastructure, as it allows for full system compromise, data theft, and lateral movement within the network. Given the CVSS score of 9.9, the potential for total loss of confidentiality, integrity, and availability is extremely high. Exploitation could lead to unauthorized access to sensitive source code, internal credentials, and backend build environments.

Immediate Action: Upgrade Forgejo instances to version 16.0.4 or 15.0.8 immediately to apply the necessary security patches.

Proactive Monitoring: Review web server and application access logs for unusual repository interactions or unexpected process execution patterns originating from the template expansion engine.

Compensating Controls: Implement strict network segmentation for the Forgejo server and restrict repository creation permissions to trusted users to reduce the attack surface until patching is complete.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for remote code execution, requires an immediate deployment of the provided patches. Organizations should prioritize updating their Forgejo installations to version 16.0.4 or 15.0.8 to eliminate the risk of unauthorized command execution. Failure to remediate this issue promptly could lead to significant security breaches and long-term compromise of the development lifecycle.