CVE-2026-89094 is a critical remote code execution vulnerability in Forgejo, a widely-used open-source, self-hosted Git service and lightweight alternative to platforms such as GitLab - already judged relevant to Vanuatu in Advisory 302 and Advisory 309. When a repository is created from a "template repository," Forgejo performs variable expansion on files placed under .forgejo/template inside that template. The expansion process could be abused to recreate a .git folder with attacker-controlled content; Git then adopts this malicious folder during initialization of the new repository, which can lead to remote code execution and arbitrary data access on the host running Forgejo.

Affected systems are any self-hosted Forgejo instance running a pre-patch version.

Forgejo, versions prior to 16.0.4 - (Affected)
Forgejo, version 16.0.4 and later - (Not affected, patched)

Any instance reachable by an authenticated user with repository or template creation privileges is exposed to this vector, so this should be treated as a priority remediation target rather than a theoretical risk.

This flaw requires only a low-privileged authenticated account able to create or control a template repository; no additional interaction beyond ordinary template use is needed.

Step 1 - Create or Control a Template Repository

An attacker holding a low-privileged authenticated account on a Forgejo instance creates, or gains control of, a repository marked as a "template repository," and places crafted content under .forgejo/template designed to be mishandled during variable expansion.

Step 2 - Trigger Template Expansion and Gain Code Execution

When a new repository is generated from that template, the flawed expansion process can recreate a .git folder with attacker-controlled content, which Git then adopts during initialization - resulting in arbitrary code execution and arbitrary data access on the server hosting Forgejo.

Successful exploitation may allow an attacker to execute arbitrary code and access arbitrary data on the server hosting a Forgejo instance, compromising the confidentiality and integrity of an organization's source code repositories and CI/CD secrets, creating a supply-chain risk and a path to pivot further into the connected network.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade every self-hosted Forgejo instance to version 16.0.4 or later without delay.

2. Restrict Template-Repository Privileges Where Patching Must Be Delayed

   Limit the ability to create or control template repositories to trusted, need-to-know accounts until the upgrade is applied, and treat any account holding this privilege as a priority review target.

3. Audit Existing Template Repositories

   Review all existing template repositories and their .forgejo/template contents for unexpected or unauthorized modifications that could indicate attempted exploitation.

4. Review Server Logs for Unexpected Activity

   Check Forgejo server and repository-creation logs for unusual template-based repository generation or unexpected process activity on the host.

Report any suspected compromise involving a self-hosted Forgejo instance to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.