PT-2025-53429 · Forgejo · Forgejo

Scott Tolley · Published 2025-12-18 · Updated 2025-12-26 · CVE-2025-68937

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 13.0.2 Forgejo version 11.0.7 and later

Description The software contains a flaw related to the handling of symlinks within template repositories. This mishandling could allow attackers to write to unintended files, potentially gaining server shell access. The issue stems from out-of-repository symlink destinations. The vulnerability enables unauthorized file write through symlink traversal in template repositories, potentially leading to remote code execution.

Recommendations Forgejo versions prior to 13.0.2 should be updated to version 13.0.2 or later. Forgejo version 11 LTS should be updated to version 11.0.7 or later.

Fix

RCE

Weakness Enumeration

CWE-61

Related Identifiers

BDU:2025-16352

CVE-2025-68937

Affected Products

Forgejo

References · 15

• https://bdu.fstec.ru/vul/2025-16352 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68937 · Security Note
• https://t.me/cveNotify/146841 · Telegram Post
• https://codeberg.org/forgejo/security-announcements/issues/43 · Note
• https://codeberg.org/forgejo/forgejo?spm=a2ty_o01.29997173.0.0.a5655171bbYC4E · Note
• https://twitter.com/CVEnew/status/2004457744204800276 · Twitter Post
• https://t.me/cveNotify/146840 · Telegram Post
• https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md · Note
• https://blog.gitea.com/release-of-1.24.7 · Note
• https://codeberg.org/forgejo/forgejo/milestone/27340 · Note
• https://twitter.com/VulmonFeeds/status/2004351022597132314 · Twitter Post
• https://t.me/CVEtracker/40680 · Telegram Post
• https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7.md · Note
• https://codeberg.org/forgejo/forgejo/milestone/29156 · Note
• https://twitter.com/0dayPublishing/status/2004347841536217399 · Twitter Post