forgejo has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 3. The median CVSS is 4.8 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- Forgejo 6
Worst active — by depth score
CVE-2026-89094Critical· 9.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.55CVE-2026-119546Medium· 5.5Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo42CVE-2026-119545Medium· 5.3Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery41CVE-2026-119547Medium· 4.3Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}24CVE-2026-90679Medium· 4.3Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification24
forgejo vulnerabilities
CVEs affecting forgejo, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-119545Medium· 5.3PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identif…
CVE-2026-119547Medium· 4.3PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user…
CVE-2026-119546Medium· 5.5PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can suppl…
CVE-2026-90679Medium· 4.3Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an …
CVE-2026-89151Low· 3.5Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
CVE-2026-89094Critical· 9.9Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.