Forgejo vulnerabilities
We track 3 vulnerabilities in Forgejo products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2026.
Latest Forgejo vulnerabilities
- 9.9 Critical severity
Forgejo: Improper Neutralization of Special Elements Used in a Template Engine
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
- 9.5 Critical severity
Forgejo: UNIX Symbolic Link (Symlink) Following
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
- 9.1 Critical severity
Forgejo: Incorrect Permission Assignment for Critical Resource
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unau