CVE-2026-89094: Forgejo

Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Affected products

• Forgejo Forgejo: from 16.0.0, before 16.0.4 (fixed in 16.0.4); before 15.0.8 (fixed in 15.0.8)

Published 2026-09-10. Last modified 2026-09-22.