Forgejo 16.0.4 and 15.0.8 address critical security vulnerability

The Forgejo software-forge project has announced therelease of versions 16.0.4and 15.0.8,which fixes two security vulnerabilities. One is a critical flaw that wouldallow remote-code execution (RCE):

When generating a new repository from a template repository, Forgejo clones thetemplate repository, removes the .git folder, performs variable templateexpansion on files listed in .forgejo/template, and initializes a new gitrepository. During this process, variable template expansion could be misused inorder to create a new .git folder, which git would adopt and incorporate duringits initialization of a new git repository. A malicious template repositorycould be used to read arbitrary data from the Forgejo host, and to executearbitrary processes on the Forgejo host, as a remote code execution attack. Toaddress this issue, after variable expansion is completed, any existing .gitfolder is removed from the directory before the git repository is initialized.

The project recommends upgrading to the latest version as soon aspossible.