CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
- Published Sep 10, 2026
- CVSS 9.9 critical
- 0.9% chance of exploitation in the next 30 days (EPSS)
- A fix is available