CVE-2026-119546: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

Published Oct 30, 2026

Updated

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Forgejo instances where an administrator restores an attacker-supplied repository dump are exposed. The affected restore operation processes crafted release asset paths from the dump.

What does an attacker need to exploit it?

An attacker needs to provide a repository dump containing a release.yml file with DownloadURL or PatchURL values that include ../ sequences. An administrator must then restore that dump.

Is user interaction required?

Yes. Exploitation requires an administrator to perform the restore of the crafted dump; the supplied data does not indicate that ordinary repository activity alone triggers the issue.

What is the impact of a successful exploit?

The attacker can cause files outside the dump directory to be read and imported as release attachments. The description gives app.ini as an example of a file that could be exposed.

CVE-2026-119546: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What is the impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What is the impact of a successful exploit?