Security patch to Forgejo v16.0.5

Publication date: 2026-09-17

We’ve updated the OpenCommit platform to Forgejo v16.0.5 tonight due to a security release made by the Forgejo project earlier today, in fixing a critical CVE..

From the Forgejo release notes

CRITICAL

• Prevent ApplyDiffPatch from mutating bare repo config. When a patch is applied to a Forgejo repo through Forgejo’s Web UI, Web cherry-pick, or /diffpatch API, a git apply --index command-line is executed to apply the patch to a temporary bare git repository. An unusual behaviour of git apply can cause arbitrary files the working direction to be changed, which is within the bare repository, and that behaviour can be abused by a malicious user to perform unexpected operations on the Forgejo host.

  This vulnerability allows execution of arbitrary processes on the Forgejo host as a remote code execution attack. The issue has been addressed by ensuring that the working directory is an unrelated temporary directory.

  This vulnerability is a variation on PR 13705, a vulnerability that was fixed in Forgejo v15.0.6. This variation was not detected at that time.

• Prevent CSRF attacks on OpenID identity associations. When OpenID sign-in is enabled on a Forgejo host, a logged-in user can add an additional OpenID address to their user account in the /user/settings/security page. The HTTP endpoint responsible for registering an OpenID address is an HTTP GET request, as required by the OpenID specification. The endpoint was vulnerable to a CSRF attack where an unexpected GET request generated by a user’s browser can register an unexpected OpenID identity on their currently logged-in Forgejo account.

  The vulnerability has been remediated by validating that a request to add an OpenID identity is initiated by the currently logged-in user.

Lastly

As always, the upgrade happened without any changes to your repositories, branches, or settings. Everything is exactly where you left it. If you spot anything that behaves differently, don’t hesitate to let us know.

For the full release notes, we’d like to refer you to Forgejo themselves: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.5.md