Forgejo 16.0.4 and 15.0.8 address critical security vulnerability

Forgejo released versions 16.0.4 and 15.0.8 to patch two security vulnerabilities, including a critical remote-code execution flaw in the repository template generation process. The bug allowed a malicious template repository to reintroduce a .git folder during variable expansion, which git would then adopt during initialization, enabling arbitrary code execution and data exfiltration on the Forgejo host. The project urges all users to upgrade immediately.

Source: https://lwn.net/Articles/1093671. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.