CVE-2026-119546
Deferred Deferred - Pending Action

Path Traversal in Forgejo via Restore-Repo

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119546
EUVD
EUVD-2026-113811

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgejo forgejo 0
forgejo forgejo 16.0.0
forgejo forgejo 17.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119546 is a path traversal vulnerability in Forgejo's repository restore functionality. It allows attackers to read files outside the intended dump directory by crafting asset paths with ../ sequences in release.yml or PatchURL fields. When an administrator restores a malicious dump, the system imports sensitive files like app.ini as release attachments, enabling arbitrary file reads via Local File Inclusion (LFI).

Detection Guidance

Check Forgejo versions for affected releases (15.0.11, 16.0.0-16.0.7, 17.0.0-17.0.1). Inspect restore-repo logs for unusual file paths or failed restores. Use commands like 'forgejo version' to verify installed version and 'grep' to search logs for path traversal attempts.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the system where Forgejo is running, such as configuration files (app.ini), tokens, or database passwords. An attacker needs to trick an administrator into restoring a malicious dump file. The impact includes potential data breaches, unauthorized access, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable Forgejo versions may face compliance violations, legal penalties, or reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Forgejo to patched versions (15.0.12+, 16.0.8+, 17.0.2+). Avoid restoring untrusted dumps. Implement strict input validation for release.yml and pull_request.yml files. Monitor for suspicious file reads or API requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart