Forgejo Security Bulletin: Critical Symlink RCE, Medium SSR/DoS, and Email Leakage Fixes

Key Information Summary Vulnerability Details 1. Critical Vulnerability: Prevent Writing External Symbolic Links During Template Repository Evaluation - CVSS: 9.5 Critical - Remediation: Fixed by sandboxing file access. - Description: Attackers could exploit this vulnerability to cause file corruption or remote shell access on the Forgejo server via symbolic links. 2. Medium Vulnerability: Prevent .forgejo/template from Reading External Content - CVSS: 6.9 Medium - Remediation: Fixed by sandboxing file access in newly created repositories. - Description: Forgejo follows symbolic links pointing outside the template repository, leading to resource exhaustion. 3. Medium Vulnerability: Return Error When LFS Token Parsing Fails - CVSS: 6.3 Medium - Remediation: Return an error when LFS token parsing fails. - Description: Users downloading LFS files they don’t have permission to access could abuse LFS tokens, causing service unavailability. 4. Low Vulnerability: Prevent Commit API from Leaking User’s Hidden Email Address on Valid GPG Signed Commits - CVSS: 2.3 Low - Remediation: Fixed by returning the signer’s identity instead of the primary account email address to prevent leakage. - Description: Visitors could view the primary email address of GPG-signed commit authors via the API, potentially leading to security issues. Release Notes Security Fixes: - Fixed the issue where the Commit API leaked users’ hidden email addresses. - Fixed the vulnerability allowing writing external symbolic links. - Fixed the issue of external symbolic link hot-reads in template files. - Fixed the LFS token parsing issue. Other Changes: - Upgraded Go language version to 1.25 for improved compatibility and security. - Optimized error handling for database migrations. - Updated dependencies to v1.25.

Goal Reached Thanks to every supporter — we hit 100%!

Forgejo Security Bulletin: Critical Symlink RCE, Medium SSR/DoS, and Email Leakage Fixes