# Docker & Containers, News

Published articles for Docker & Containers, News.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE

DevFeed: [Forgejo 16.0.4 and 15.0.8 Fix Critical Repository Template RCE](<https://devfeed.tech/articles/forgejo-16-0-4-and-15-0-8-fix-critical-repository-template-rce-10719.md>)

Original publisher: [Read original article](<https://selfhostlab.io/forgejo-16-0-4-security-release/>)

Author: Christian Rakoot

Published: 2026-09-12T06:40:18Z

Content type: article

Language: en

Sources: [Self Host Lab](<https://devfeed.tech/sources/self-host-lab.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [releases](<https://devfeed.tech/topics/releases.md>), [Security](<https://devfeed.tech/topics/security.md>), [Template](<https://devfeed.tech/topics/template.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [API](<https://devfeed.tech/topics/api.md>), [Git](<https://devfeed.tech/topics/git.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [docker-containers](<https://devfeed.tech/tags/docker-containers.md>), [docker-containers-news](<https://devfeed.tech/tags/docker-containers-news.md>), [forgejo](<https://devfeed.tech/tags/forgejo.md>), [git](<https://devfeed.tech/tags/git.md>), [news](<https://devfeed.tech/tags/news.md>), [release](<https://devfeed.tech/tags/release.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [update](<https://devfeed.tech/tags/update.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

Forgejo 16.0.4 and 15.0.8 fix a critical remote code execution vulnerability in repository-template creation, along with an API authorization bypass. The article explains how malicious template variables could restore a .git directory with executable hooks and urges affected self-hosted instances to update.

### Source excerpt

Forgejo 16.0.4 and 15.0.8 patch a critical remote code execution vulnerability in repository templates, tracked as CVE-2026-89094 with a CVSS score of 9.9, plus a narrower API permission bypass. Any instance on 16.0.3 or earlier, or 15.0.7 or earlier on the LTS branch, is vulnerable. Here's what happened, why it matters, and how to update.