5.5
MediumCVSS 3.1 · from VulnCheck
CVE-2026-119546
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
forgejo · Path traversal · CWE-22Affectedforgejo
FixA patch is linked in the references.
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 5.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.
Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inforgejoup to 15.0.11–forgejo16.0.0 – 16.0.7–forgejo17.0.0 – 17.0.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known