Live › vulnerability › CVE-2026-119546
Forgejo's restore-repo command trusts ../ sequences in a dump's release.yml download or patch URLs. A crafted dump lets an attacker make a restore import files like app.ini, outside the dump directory, as release attachments.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that run a self-hosted Forgejo instance on an affected version and restore repositories from dump files, especially dumps from untrusted sources. The attacker needs a dump they can get an administrator to restore. Teams that never run restore-repo on outside dumps are less exposed.
No product ranges from the sources yet.
forgejo --version on the server and compare it with the affected ranges: through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1.restore-repo with dump files from outside sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
This page as .md · .json · in your agent: get_signal("CVE-2026-119546")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.