Vulnerabilities in Forgejo
5 resultsVexday analysis
Forgejo apresenta footprint mínimo de risco com apenas 1 CVE crítica registrada na base, sem evidência de exploração ativa em campo (KEV = 0) e sem publicações recentes. A vulnerabilidade identificada (CWE-61: caminho local não apropriadamente restringido) sugere uma falha de validação de caminho que requer contexto específico para ser explorada, mantendo o risco operacional contido.
CVE-2026-89094CRITICALForgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templatEPSS 0.5%CVE-2025-68937CRITICALForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-EPSS 0.5%CVE-2026-59102LOWForgejo < 15.0.3 - Stored XSS via Actions Run Full Name RenderingEPSS 0.3%CVE-2026-90679MEDIUMForgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not EPSS 0.2%CVE-2026-89151LOWForgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.EPSS 0.1%