CVE-2025-68937
Description
A flaw was found in Forgejo. This vulnerability allows a remote attacker to write to unintended files and potentially gain server shell access. The flaw occurs due to mishandling of symlink destinations that point outside of the repository when processing template repositories. This could lead to unauthorized control over the server.
Statement
This vulnerability is rated MODERATE because although it allows a remote attacker with low privileges to achieve server shell access in Forgejo due to improper handling of symlinks in template repositories, Red Hat's software safety guardrails in EPEL and Fedora limits the exploitability of this vulnerability on our systems. It affects Forgejo as distributed in Red Hat Community Projects, including Fedora and EPEL.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
