CVE

A Forgejo Template Repo Could Plant Its Own .git Folder and Git Would Adopt It

Forgejo 16.0.4 fixes a CVSS 9.9 remote code execution bug that needs no exploit code, just a directory name. We reproduced the git primitive underneath it in about four minutes.