Bug 2563976 (CVE-2026-119546) - CVE-2026-119546 forgejo: forgejo: Information disclosure via path traversal in repository restore
Summary: CVE-2026-119546 forgejo: forgejo: Information disclosure via path traversal i...
Keywords:
Status: NEW
Alias: CVE-2026-119546
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2565523 2565525 2565526 2565527
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 12:54 UTC by OSIDB Bzimport
Modified: 2026-11-03 02:32 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 12:54:17 UTC 
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
Note You need to log in before you can comment on or make changes to this bug.