OpenSourceChoice verdict: upgrade Forgejo 16.x to 16.0.4 or the supported 15.x LTS line to 15.0.8 now. CVE-2026-89094 lets a low-privileged network user turn a crafted repository template into host-level data access and process execution. Public and multi-user instances come first, but a private instance is not exempt. After patching, audit template activity and rotate exposed credentials if the history is not explainable.
This researched response was checked on September 11, 2026. We reviewed current primary sources and independent discussions, but did not exploit Forgejo or test a live upgrade.
The decision at a glance
| Question | Assessment |
|---|---|
| Fixed versions | Forgejo 16.0.4 and 15.0.8 LTS, released September 10 |
| Affected range | 16.0.0–16.0.3 and versions earlier than 15.0.8 |
| Highest priority | Internet-reachable or multi-user instances where untrusted accounts can create and use repository templates |
| Main risk | Arbitrary reads and processes with the Forgejo service account's access |
| Real cost | Consistent backup, maintenance window, upgrade validation, log review and possible credential rotation |
| Primary alternative | Current Gitea, evaluated after containment—not used as a substitute for patching |
Why this patch matters now
Forgejo released 16.0.4 and 15.0.8 on September 10. The CVE record assigns CVSS 9.9: network reachable, low privileges required, no user interaction and high confidentiality, integrity and availability impact. Hacker News reached 155 points and 57 comments during our check; Lobsters, r/netsec and LWN added independent attention. These are urgency signals, not proof of exploitation.
The vulnerability sits in repository creation from a template. Forgejo first removes the template's .git directory, expands variables in files named by .forgejo/template, then initializes the new repository. A malicious expansion could recreate .git; Git would adopt that attacker-controlled metadata during initialization. The release notes say this can read arbitrary host data and execute arbitrary processes. The fix removes any resulting .git directory after expansion and before initialization.
This is not described as a zero-account attack. Exposure depends on who can create template repositories and generate repositories from them. Closed registration reduces the attacker pool, but does not make every existing account trusted.
What 16.0.4 fixes—and what it cannot prove
The patch closes the template-to-Git chain. It also fixes authorization paths where a repo-scoped API token could modify content beyond its restriction and readers could access draft-release attachments. Treat the update as a security bundle, not only an RCE hotfix.
Installing it cannot prove the old instance was never exploited. Forgejo may hold private source, attachments, packages, OAuth credentials, deploy keys and encrypted Actions secrets. Its documentation also warns that host runners have no meaningful isolation.
Our editorial inference is straightforward: if an untrusted account could use templates during the vulnerable window and the audit trail contains unexplained repository creation, patching is containment, not closure. Preserve evidence, isolate the host and follow the organization's incident-response process before deleting data or rebuilding.
Choose the supported patch line
Forgejo 16 is supported until October 29, 2026; version 15 LTS until July 15, 2027. Make the smallest emergency change: 16.x to 16.0.4 or 15.x to 15.0.8. Discontinued releases need a planned move to a supported line.
Official binaries include checksums and GPG signatures; OCI images provide exact and moving tags. Record the exact version or digest deployed so it matches the tested artifact.
The upgrade guide requires a consistent backup even for a patch. Distributed databases, object storage and queues may require shutdown, and Forgejo warns that forgejo dump has database export limitations. The real cost is proving that repositories, database, attachments and secrets restore together.
A measurable patch-and-audit runbook
Rehearse on a staging copy when possible, but do not postpone an exposed production instance for a long pilot.
| Gate | Pass condition |
|---|---|
| Inventory | Record forgejo --version, deployment method, image digest, database, storage, runner registrations and network exposure |
| Recovery | Create a synchronized backup and prove a clean restore on an isolated host before production changes |
| Artifact | Pin 16.0.4 or 15.0.8 and verify the official checksum/signature or OCI digest |
| Upgrade | Flush queues, take the required maintenance window, replace the binary/image and preserve configuration |
| Integrity | forgejo doctor check --all --log-file /tmp/doctor.log reports no unexplained problem |
| Function | Login, clone, push, pull request, package access and one harmless trusted-template creation all pass |
| Actions | Trusted workflows run only on expected runners; no runner or secret scope expands |
| Audit | Repository-template creation and host changes during the vulnerable window are attributable to known users and work |
| Recovery objective | The team can restore the pre-upgrade snapshot within its declared RTO if validation fails |
Do not test with a weaponized template on production. If activity is suspicious, preserve logs and snapshots, then rotate Forgejo and runner-reachable credentials according to scope. A clean functional test is not a forensic finding.
Security, privacy, license and maintenance
Forgejo publishes a security contact and announcements repository. Same-day fixes for stable and LTS are a positive maintenance signal; commits continued September 11. The application is GPL-3.0-or-later and its documentation is CC BY-SA 4.0.
Self-hosting keeps repository data under operator control, but transfers patch timing, backups, logging, secret rotation and runner isolation to that operator. Our self-hosted starter kit treats Forgejo as an operated service, not “bare Git with a UI.”
Should you switch to Gitea?
Gitea merged equivalent cleanup in February and shipped it in 1.25.5; current stable was 1.27.3 when checked. It is the obvious alternative to evaluate, and our GitHub alternatives comparison covers the wider trade-offs.
Do not migrate during the emergency to avoid one patch. Forgejo no longer promises general Gitea compatibility, and migration adds database, identity, webhook, package and Actions risk. Patch and audit first; reassess long-term fit later.
Conclusion
CVE-2026-89094 turns a collaboration feature into a host boundary failure. Deploy 16.0.4 or 15.0.8, verify the service, then decide whether the vulnerable period needs incident response.
Prioritize instances with untrusted users and public reachability. Pin the artifact, restore-test the backup, review template activity and include runner credentials in the audit. The patch closes the bug; evidence closes the incident.
Sources and research record
Sources were accessed September 11, 2026. Dynamic discussion counts are observations from that check. No hands-on exploit or live Forgejo upgrade was performed.
- Vulnerability and fixes: CVE-2026-89094 record, Forgejo 16.0.4 release notes and 15.0.8 LTS release notes.
- Upgrade and artifacts: upgrade guide, official downloads and signature instructions, Docker installation and tag policy and release schedule.
- Security and project state: security team and GPL licensing FAQ, Actions security model, current repository activity and security announcements.
- Alternative: Gitea path-resolution fix, Gitea 1.25.5 release and current Gitea 1.27.3 release.
- Independent interest: Hacker News discussion, Lobsters discussion, r/netsec discussion and LWN report.
Build a stack for this use case.
Answer nine practical questions and compare three transparent architectures with costs, free limits, lock-in, and migration paths.
Build my stack
