Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
forgejo forgejo
Default version status: unaffected
0 to ≤ 15.0.11affected16.0.0 to ≤ 16.0.7affected17.0.0 to ≤ 17.0.1affected
References
- https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/services/migrations/restore.go#L154 ↗
- https://abraxaslabs.tech/research/forgejo-restore-file-open ↗
- https://github.com/go-gitea/gitea/pull/38215 ↗
- https://github.com/go-gitea/gitea/security/advisories/GHSA-xmj7-xj85-hfc3 ↗
- https://codeberg.org/forgejo/forgejo ↗
- https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-path-traversal-via-restore-repo ↗