Vulnerability in Forgejo
CVE-2025-68937
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (40.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: -0.000
Affected products
- Forgejo — versions 12.0.0, 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2…
- codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7…
- codeberg.org/forgejo/forgejo/milestone/29156
- codeberg.org/forgejo/forgejo/milestone/27340
- codeberg.org/forgejo/security-announcements/issues/43
- blog.gitea.com/release-of-1.24.7/
Frequently asked questions
- What is CVE-2025-68937?
- CVE-2025-68937 is a vulnerability in Forgejo, classified under UNIX Symbolic Link (Symlink) Following. Published 2025-12-26.
- Is CVE-2025-68937 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.