CVE Catalog
CVE-2025-68937
CriticalSummary
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
Risk Assessment
An attacker can write files outside the repository, potentially leading to modification of critical system files or gaining remote server access.
Recommendation
Update Forgejo to version 13.0.2 or later, and for 11 LTS to 11.0.7 or later.
Original NVD description (English source)
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.