Forgejo before 16.0.4

CVE-2026-89094 is a remote code execution flaw in Forgejo's repository-from-template feature. When a user creates a new repository from a template, Forgejo clones the template, deletes .git, expands variables listed in .forgejo/template, then runs git init. A crafted template can abuse variable expansion to recreate a .git/hooks/ directory containing executable scripts. When git init fires, it adopts the pre-existing .git folder and runs those hooks as the Forgejo service account — giving the attacker arbitrary OS-level command execution. Affected versions: Forgejo 16.0.0–16.0.3, all versions prior to 15.0.8 (LTS branch), and Gitea ≤ 1.25.4 (shared codebase).

The vendor rates this CVSS 9.9 CRITICAL with Scope Changed (S:C), meaning the compromise escapes the Forgejo application boundary into the underlying OS. That rating is accurate and, if anything, generous only in not being a flat 10.0. The PR:L (low privilege) prerequisite is nearly zero friction on a code forge: any registered user can own a repo, mark it as a template, create from it, and pop the box. Forgejo *is* the supply chain — it holds every repo, every CI secret, every deploy key. A compromised Forgejo host gives an attacker silent code injection across every project it hosts.

Why this verdict

• Trivial attack chain: A single authenticated user can go from account creation to full RCE in three clicks — create repo, mark as template, create from template. No race condition, no memory corruption, no brute force.
• Role multiplier — supply-chain-scale blast radius: Forgejo/Gitea IS the code forge. ≥90% of Forgejo installations exist specifically to host source code and CI/CD pipelines. Compromising the Forgejo host grants read/write access to every repository, every deploy key, every CI runner token. The chain ends in supply-chain compromise, meeting the CRITICAL floor.
• Scope Changed (S:C) is real: Execution escapes the Forgejo application into the host OS as the service account. From there, lateral movement to CI runners, databases, and artifact stores is a standard post-exploitation playbook.
• Gitea shares the vulnerable codebase: The blast radius extends beyond Forgejo to the much larger Gitea installed base (Gitea ≤ 1.25.4), multiplying the population of vulnerable instances significantly.
• Minimal friction on default configs: Gitea ships with open registration enabled. Many legacy Forgejo instances predate the default-off change. The PR:L barrier is effectively PR:N for a meaningful fraction of the installed base.

Why not higher?

A 10.0 would require PR:N (no authentication at all). The CVSS vector correctly reflects PR:L, and on instances with self-registration disabled and behind VPN, the attacker does need a valid credential or internal network position. The 9.9 accurately captures this single friction point.

Why not lower?

Downgrading below CRITICAL would require that the target component is NOT canonically a high-value supply-chain asset, or that the chain has significant real-world friction. Neither applies here. Forgejo is, by definition, the source-code store — the supply chain itself. The chain has near-zero friction for any authenticated user. Even on locked-down instances, any insider or compromised credential holder can exploit this in seconds. The CRITICAL floor set by the role multiplier cannot be broken without evidence that <1% of Forgejo instances hold meaningful source code, which is counterfactual.

1. Patch to Forgejo 16.0.4 / 15.0.8 / Gitea 1.25.5 immediately — The patch removes any recreated .git directory after template variable expansion and before git init. This is the definitive fix. Under the noisgate mitigation SLA for CRITICAL, deploy within 3 days (by 2026-09-13 given disclosure on 09-10).
2. Disable repository-from-template creation — If immediate patching is blocked, disable the template-repository feature at the application level or via reverse-proxy rules blocking the /repo/create endpoint with template parameters. This eliminates the attack surface entirely until the patch is applied.
3. Restrict repository creation to admin-approved users — Set DISABLE_REGISTRATION = true and limit repo-creation permissions to trusted teams. This raises the PR:L bar from 'anyone on the internet' to 'vetted internal users', reducing (but not eliminating) risk.
4. Monitor Forgejo process for anomalous child processes — Deploy an EDR rule or auditd filter alerting on the Forgejo service account spawning unexpected shell processes, particularly from paths containing /hooks/. This provides detection-in-depth while patching is underway.
5. Audit existing repos created from templates — Search the Forgejo data directory for repositories containing .git/hooks/ scripts with executable content that was not placed there by Forgejo itself. Any findings indicate possible prior exploitation.

Run this script on the Forgejo/Gitea host as any user with read access to the Forgejo binary. Example: bash check_cve_2026_89094.sh /usr/local/bin/forgejo or bash check_cve_2026_89094.sh /usr/local/bin/gitea. No elevated privileges required beyond reading the binary version.

#!/usr/bin/env bash
# check_cve_2026_89094.sh — Detect CVE-2026-89094 (Forgejo/Gitea template RCE)
# Usage: bash check_cve_2026_89094.sh /path/to/forgejo|gitea
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

BINARY="${1:-}"
if [[ -z "$BINARY" ]]; then
  echo "Usage: $0 /path/to/forgejo|gitea"
  exit 2
fi

if [[ ! -x "$BINARY" ]]; then
  echo "UNKNOWN — binary not found or not executable: $BINARY"
  exit 2
fi

VERSION_OUTPUT=$( "$BINARY" --version 2>/dev/null || true )
# Expect output like: "Forgejo version 16.0.4 built with ..." or "Gitea version 1.25.5 ..."

if echo "$VERSION_OUTPUT" | grep -qi 'forgejo'; then
  PRODUCT="forgejo"
  VER=$(echo "$VERSION_OUTPUT" | grep -oP '\d+\.\d+\.\d+' | head -1)
elif echo "$VERSION_OUTPUT" | grep -qi 'gitea'; then
  PRODUCT="gitea"
  VER=$(echo "$VERSION_OUTPUT" | grep -oP '\d+\.\d+\.\d+' | head -1)
else
  echo "UNKNOWN — could not determine product from version output: $VERSION_OUTPUT"
  exit 2
fi

if [[ -z "$VER" ]]; then
  echo "UNKNOWN — could not parse version number from: $VERSION_OUTPUT"
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VER"

if [[ "$PRODUCT" == "forgejo" ]]; then
  # Patched: 16.0.4+ or 15.0.8+
  if (( MAJOR > 16 )); then
    echo "PATCHED — $PRODUCT $VER"
    exit 0
  elif (( MAJOR == 16 && MINOR == 0 && PATCH >= 4 )); then
    echo "PATCHED — $PRODUCT $VER (>= 16.0.4)"
    exit 0
  elif (( MAJOR == 16 && MINOR > 0 )); then
    echo "PATCHED — $PRODUCT $VER (16.x > 16.0)"
    exit 0
  elif (( MAJOR == 15 && MINOR == 0 && PATCH >= 8 )); then
    echo "PATCHED — $PRODUCT $VER (>= 15.0.8 LTS)"
    exit 0
  elif (( MAJOR == 15 && MINOR > 0 )); then
    echo "PATCHED — $PRODUCT $VER (15.x > 15.0)"
    exit 0
  else
    echo "VULNERABLE — $PRODUCT $VER (needs 16.0.4+ or 15.0.8+)"
    exit 1
  fi
elif [[ "$PRODUCT" == "gitea" ]]; then
  # Patched: 1.25.5+
  if (( MAJOR > 1 )); then
    echo "PATCHED — $PRODUCT $VER"
    exit 0
  elif (( MAJOR == 1 && MINOR > 25 )); then
    echo "PATCHED — $PRODUCT $VER"
    exit 0
  elif (( MAJOR == 1 && MINOR == 25 && PATCH >= 5 )); then
    echo "PATCHED — $PRODUCT $VER (>= 1.25.5)"
    exit 0
  else
    echo "VULNERABLE — $PRODUCT $VER (needs 1.25.5+)"
    exit 1
  fi
fi

echo "UNKNOWN — unhandled version: $PRODUCT $VER"
exit 2

Sources

1. Forgejo Release Notes — v16.0.4 and v15.0.8
2. SecurityOnline — CVE-2026-89094 Forgejo RCE Analysis
3. ByteIota — Forgejo CVE-2026-89094 CVSS 9.9 RCE
4. LWN.net — Forgejo 16.0.4 and 15.0.8 Security Advisory
5. THREATINT — CVE-2026-89094
6. VulDB — CVE-2026-89094
7. Forgejo Hardening Guide — Disable Self-Registration
8. Lobsters Discussion — Forgejo 16.0.4 Critical Fix