Security patch naar Forgejo v16.0.5

Publicatie datum: 2026-09-17

We hebben vanavond het OpenCommit platform geupgrade naar Forgejo v16.0.5 vanwege een security release, eerder vandaag uitgebracht door het Forgejo project, om een critische CVE te patchen.

Uit de Forgejo release notes

CRITICAL

  • Prevent ApplyDiffPatch from mutating bare repo config. When a patch is applied to a Forgejo repo through Forgejo’s Web UI, Web cherry-pick, or /diffpatch API, a git apply --index command-line is executed to apply the patch to a temporary bare git repository. An unusual behaviour of git apply can cause arbitrary files the working direction to be changed, which is within the bare repository, and that behaviour can be abused by a malicious user to perform unexpected operations on the Forgejo host.

    This vulnerability allows execution of arbitrary processes on the Forgejo host as a remote code execution attack. The issue has been addressed by ensuring that the working directory is an unrelated temporary directory.

    This vulnerability is a variation on PR 13705, a vulnerability that was fixed in Forgejo v15.0.6. This variation was not detected at that time.

  • Prevent CSRF attacks on OpenID identity associations. When OpenID sign-in is enabled on a Forgejo host, a logged-in user can add an additional OpenID address to their user account in the /user/settings/security page. The HTTP endpoint responsible for registering an OpenID address is an HTTP GET request, as required by the OpenID specification. The endpoint was vulnerable to a CSRF attack where an unexpected GET request generated by a user’s browser can register an unexpected OpenID identity on their currently logged-in Forgejo account.

    The vulnerability has been remediated by validating that a request to add an OpenID identity is initiated by the currently logged-in user.

Tot slot

Zoals altijd vond de upgrade plaats zonder wijzigingen aan je repositories, branches of instellingen. Alles staat precies waar je het hebt achtergelaten. Als je iets tegenkomt dat zich anders gedraagt, aarzel dan niet om het ons te laten weten.

Voor de volledige release notes verwijzen we je graag naar Forgejo zelf: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.5.md