CVE-2026-119546Medium· 5.5▾ TwilightPoC availableForgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can suppl…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
Exploit / PoC code exists
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
forgejo <= 15.0.11forgejo >= 16.0.0 <= 16.0.7forgejo >= 17.0.0 <= 17.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119545Medium· 5.3Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
CVE-2026-119547Medium· 4.3Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
CVE-2026-90679Medium· 4.3Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification
CVE-2026-89151Low· 3.5Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
CVE-2026-89094Critical· 9.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVE-2021-21972Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin