Forgejo RCE Vulnerability Highlights Self-Hosted Git Risk

A critical remote code execution vulnerability was disclosed in Forgejo versions up to 16.0.3, triggered by a bug in template expansion during repository initialization from a template. The fix is in, but the thread shows the usual mix of people who hadn't heard of Forgejo, people who rely on it for self-hosted Codeberg alternatives, and people casually noting their instance is behind an auth proxy so they feel okay.

Forgejo is the community fork of Gitea that powers Codeberg, which has become a meaningful alternative to GitHub for people who want self-hosted or EU-jurisdiction Git. An RCE in the core template-to-repo flow is about as bad as it gets for a git host, because it means an attacker who can create repositories could potentially execute arbitrary code on the server.

The broader signal is that the self-hosted Git ecosystem is maturing in terms of adoption but is still thin on security infrastructure compared to GitHub or GitLab. Teams running Forgejo or Gitea in production need a patch cadence that matches GitHub's internal security team, without GitHub's security team.