Forgejo Patches a 9.9-Severity RCE in Template Repositories

Forgejo shipped version 16.0.4 on Thursday to fix CVE-2026-89094, a remote code execution flaw the National Vulnerability Database rates 9.9 out of 10 on the CVSS 3.1 scale. The vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, means the attack runs over the network with low complexity and needs only low privileges and no victim interaction, but it does require an account able to generate a new repository from a template.

How a template turns into arbitrary code execution

When Forgejo generates a repository from a template, it clones the template, strips its .git folder, expands variables in files listed under .forgejo/template, and then initializes a fresh git repository, according to Forgejo's own release notes. The bug is that variable expansion could itself be used to recreate a .git folder before that final step, which git would then adopt as legitimate during initialization. A malicious template can use that opening to read arbitrary data from the Forgejo host and execute arbitrary processes on it, the release notes say.

The fix removes any .git folder left over from expansion before git initializes the new repository. Forgejo backported the same change to the 15.x line, releasing 15.0.8 alongside 16.0.4, according to LWN.net. There is no public evidence of exploitation before the patch shipped.

Two more bugs closed the same day

16.0.4 also fixes an authorization bug and a disclosure bug, both lower-profile than the RCE.

Issue	What it allowed	Fixed in
CVE-2026-89094	RCE via crafted template repository	16.0.4, 15.0.8
API scope bypass	Restricted tokens could exceed the "allow maintainer edit" scope on pull requests	16.0.4
CVE-2026-27660 (GHSA-q9pg-jj6x-j9p6)	Unauthenticated users could read metadata and contents of draft release attachments	16.0.4

Forgejo's release notes do not assign a CVE or CVSS score to the API scope bug, and they list CVE-2026-89094 without a severity rating of their own, a gap the NVD record fills but a self-hosted admin reading only the changelog would miss. Operators who cannot upgrade immediately have no documented workaround for the template flaw beyond disabling repository generation from templates entirely, since Forgejo's notes describe only the permanent code fix.

Forgejo is a fork of Gitea distributed through Codeberg, and the "generate repository from template" feature it just patched is a routine part of onboarding new projects on a self-hosted forge, not an edge case most admins would think to restrict. That makes the fix worth applying even on instances that only let trusted staff create repositories, since the attack path runs through the template contents rather than through who is allowed to click the button.

The same day, Google's Chrome team shipped its own emergency patch for an actively exploited flaw, and Adobe closed out a comparable remote-code-execution bug in Commerce earlier in the week. Three unrelated RCE disclosures inside five days is not itself evidence of a trend, but it does mean patch queues at self-hosted shops got longer, not shorter, heading into the weekend.

Sources: NVD, CVE-2026-89094, accessed Sept. 10, 2026; Forgejo 16.0.4 release notes, Sept. 10, 2026; LWN.net, Sept. 10, 2026.