Forgejo vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20267

Newest CVEs

• CVE-2026-119547

  Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

  forgejo · forgejo

  Medium5.3
• CVE-2026-119546

  Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

  forgejo · forgejo

  Medium6.8
• CVE-2026-119545

  Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

  forgejo · forgejo

  Medium6.9
• CVE-2026-90679

  Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account…

  Forgejo · Forgejo

  Medium4.3
• CVE-2026-89151

  Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

  Forgejo · Forgejo

  Low3.5
• CVE-2026-89094

  Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

  Forgejo · Forgejo

  Critical9.9
• CVE-2026-59102

  Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering

  forgejo · forgejo

  Low2.1
• CVE-2025-68937

  Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository…

  Forgejo · Forgejo

  Critical9.5