SECURITY Signal 562
Forgejo patches critical template-repository RCE in 16.0.4 and 15.0.8
↗
Illustration only Photo by Sorin Basangeac on Unsplash
Forgejo released versions 16.0.4 and 15.0.8 fixing two security vulnerabilities, one of them a critical remote-code execution flaw reachable through a malicious template repository.
According to the advisory, exploiting the template-repository flaw lets an attacker read arbitrary data from the Forgejo host and run arbitrary processes on it, so any self-hosted instance that accepts templates from outside the trusted-admin set should upgrade promptly. Both the current 16.x line and the older 15.x line receive patches, so operators who have been deferring a major-version bump are still covered.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The critical RCE sits in the template-repository generation flow: after cloning a template and stripping its .git folder, Forgejo runs variable template expansion on files listed in .forgejo/template and then runs git init, and the expansion step can be coerced into creating a new .git directory that the subsequent git init then adopts.
With that .git adoption, the advisory states a malicious template can read arbitrary data from the Forgejo host and execute arbitrary processes there, which is effectively full-instance compromise for a self-hosted forge.
The fix removes any .git directory present after variable expansion before git initialization runs, and is shipped as a point release on both the 16.x line (16.0.4) and the 15.x line (15.0.8), keeping the adoption cost to a version bump and restart.
THE CLUSTER