ENISA's EUVD lists Forgejo path traversal flaw in restore-repo (EUVD-2026-113811)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Forgejo
- Product
- Forgejo
- First seen
Summary
The EUVD entry EUVD-2026-113811 reports a path traversal vulnerability in Forgejo's restore-repo function across several version ranges, scored 6.8/10 (CVSS v3.1). According to the entry, attackers can read files outside the dump directory using crafted asset paths.
If you use Forgejo
Identify whether your Forgejo instance runs a version through 15.0.11, 16.0.0–16.0.7, or 17.0.0–17.0.1.
Check the Forgejo advisory for a fixed release and upgrade to it.
Restrict who can run restore operations until the upgrade is applied.
Confirm whether your Forgejo instance runs a version through 15.0.11, 16.0.0–16.0.7, or 17.0.0–17.0.1.
Apply the fixed release named in the Forgejo advisory once it is available.
Review API token scopes and limit read:user tokens to necessary users.
What the sources say 3
· Mastodon: “contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups.” Source
· Mastodon: “Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths.” Source
· Mastodon: “Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability” Source