Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
The vulnerability results from improper handling of symbolic links (CWE-61: UNIX Symbolic Link Following), whose targets point to paths outside the repository directory. When such a repository is used as a template repository for creating new repositories, Forgejo does not properly verify symlink targets, allowing an attacker to write files to locations outside the intended repository area on the server. With a properly prepared attack, this can lead to placing malicious files in critical operating system locations and obtaining access to the server shell.
An attacker can write files to arbitrary locations on the server (path traversal via symlink), which in the worst case leads to obtaining remote access to the system shell (server shell access) and full server takeover.
Forgejo should be updated to version 13.0.2 or newer. For the 11 LTS branch, an update to version 11.0.7 or newer should be applied. Detailed information is available in the vendor's release notes at codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md and codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7.md
Forgejo before version 13.0.2 and versions of the 11 LTS branch before version 11.0.7
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X