Forgejo 16.0.4 and 15.0.8 address critical security vulnerability
Brief
The Forgejo software-forge project has announced the release of versions 16.
- 4 and 15.
- 8 , which fixes two security vulnerabilities. One is a critical flaw that would allow remote-code execution (RCE):
When generating a new repository from a template repository, Forgejo clones the template repository, removes the . git folder, performs variable template expansion on files listed in . forgejo/template , and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .
git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack.