CVE-2025-68937

CVE-2025-68937 - RCE через симлинк в шаблонах Gitea/Forgejo Автоматизированный proof-of-concept для CVE-2025-68937 : обход каталога через разыменование симлинков при обработке шаблонных репозиториев Gitea и Forgejo, приводящий к удалённому выполнению кода. Любой аутентифицированный пользователь б...

Gitea-Forgejo-CVE-2025-68937

Vulnérabilité d'expansion arbitraire de templates dans Gitea et Forgejo Ce travail est sous licence Creative Commons Attribution-ShareAlike 4.0 International License. Résumé En examinant le code source de Forgejo et de Gitea pour mieux comprendre comment le templating est effectué, j'ai découvert...

CVE-2026-60004

CVE-2026-60004 — RCE в Gitea через Git-хук Diffpatch Инъекция хука в bare-клон → post-index-change → Выполнение произвольных команд Обзор CVE-2026-60004 — критическая CVSS 9.8 уязвимость удалённого выполнения кода без аутентификации в самохостинговых Git-платформах Gitea и Forgejo , затрагивающая...

research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho's Knowledge Research On 2025-12-22, a security vulnerability CVE 2025-68971 CVSS: 5.5/MEDIUM was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all...

CVE-2024-45337

Preuve de concept pour CVE-2024-45337 Ce dépôt contient une preuve de concept pour CVE-2024-45337. Elle peut être utilisée pour envelopper ssh lors de l'interaction avec un serveur SSH implémenté à l'aide de golang.org/x/crypto = v0.30.0, tout en mettant en cache les permissions dans le rappel...

forgejo-longterm-15.0.8-1.1 on GA media (moderate)

forgejo-longterm-15.0.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:11846-1 Rating: moderate Cross-References: CVE-2026-27660 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:11846-1 forgejo-longterm-15.0.8-1.1 on GA media

These are all security issues fixed in the forgejo-longterm-15.0.8-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 45 : forgejo (2026-e9a6f74bd2)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e9a6f74bd2 advisory. This is an upstream bug and security fix release. Please consult the upstream release notes for more details. Tenable has extracted the preceding description...

CVE-2026-90679

A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produce...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Name of the Vulnerable Software and Affected Versions Forgejo versions 13.0.0 through 16.0.4 Description An identity spoofing issue exists when federation ENABLED = true is configured. The system fails to verify that the HTTP Signature of an incoming ActivityPub activity was generated by the key...

CVE-2026-90679: Use of Less Trusted Source

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...