CVE-2026-89094

CriticalCVSS 9.9/10Last modified Sep 22, 2026

Description

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

VendorProductVersions
ForgejoForgejo>= 16.0.0, < 16.0.4; < 15.0.8

References

Timeline

Published
Sep 10, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-890965.9A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notificatiCVE-2026-890974.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and iCVE-2026-890985.5A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertiCVE-2026-890997.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory wiCVE-2026-89106.1The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This isCVE-2026-891006.1The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL FragmentCVE-2026-891016.5The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure DiCVE-2026-891026.5In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lCVE-2026-8910310.0SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal applicatCVE-2026-891054.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUCVE-2026-891064.4SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crCVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util