Forgejo 16.0.4 fixes an RCE triggered by a malicious template repository
LWN.net (corroborated by Forgejo release notes, VulDB, Lobsters; 194 points on HN)·high signal
Forgejo 16.0.4 and 15.0.8 fix a critical bug, CVE-2026-89094. Variable expansion in a template repository's .forgejo/template files could create a new .git folder, which git then adopted when it initialized the generated repo. That allowed arbitrary file reads and process execution on the host. The fix deletes any .git folder after expansion. Anyone self-hosting Forgejo on 16.0.3 or earlier with template repos enabled should patch now.