Skip to content
OpenAdvisories

Vendor

forgejo

8 known vulnerabilities.

forgejo at a glance

Last 12 months
8
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 1 vulnerability, 1 critical Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 3 vulnerabilities, 1 critical Sep October 2026: 3 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202630
Sep 202631
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202511
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

forgejo 8
All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 4.3
    CVE-2026-119547

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can …

    forgejo forgejo
  • Medium 5.5
    CVE-2026-119546

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release…

    forgejo forgejo
  • Medium 5.3
    CVE-2026-119545

    Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

    Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers ca…

    forgejo forgejo
  • Medium 4.3
    CVE-2026-90679

    Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity in…

    forgejo forgejo
  • Low 3.5
    CVE-2026-89151

    Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

    forgejo forgejo
  • Critical 9.9
    CVE-2026-89094

    Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on file…

    forgejo forgejo
  • Medium 5.4
    CVE-2026-59102

    Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering

    Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the D…

    forgejo forgejo
  • Critical 9.5
    CVE-2025-68937 Public exploit

    Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because o…

    forgejo forgejo