Path Traversal Vulnerability in Forgejo by Codeberg

CVE-2026-119546

What is CVE-2026-119546?

Forgejo versions up to 15.0.11 and 16.0.0 to 16.0.7, along with 17.0.0 to 17.0.1 contain a critical path traversal flaw in the restore-repo feature. This vulnerability permits attackers to exploit crafted asset paths, allowing unauthorized access to files beyond the intended dump directory. By manipulating the DownloadURL or PatchURL provided in a dump's release.yml file with ../ sequences, an attacker can import sensitive files, such as app.ini, as part of the restore process. This poses a significant risk to system integrity and data confidentiality.

References