Forgejo 16.0.4 Patches Critical RCE Affecting All Versions Through 16.0.3

Forgejo, the community-run fork of the self-hosted Git forge Gitea, has shipped 16.0.4 to fix a vulnerability its maintainers classify as a critical remote code execution flaw affecting every release up to and including 16.0.3. Remote code execution in a Git forge is about as serious as it gets: a successful exploit runs attacker-controlled code on the server that hosts an organization’s source code, CI credentials, and deploy keys, making it a potential pivot point into the wider software supply chain. Administrators of self-hosted Forgejo instances should treat upgrading to 16.0.4 as urgent.

Beyond that, specifics remain unconfirmed. The linked release notes could not be retrieved for verification — the source deliberately returns garbled content to automated readers — so the CVE identifier, the exact vulnerable component, whether exploitation requires authentication or a particular configuration, and the CVSS score are not established here and should be confirmed against Forgejo’s official security advisory before any of those details are reported.

The broader takeaway holds regardless: self-hosted developer infrastructure is a high-value target, and instances exposed to untrusted or internet-facing traffic carry the most risk until patched. Operators who cannot upgrade immediately should review their exposure and access controls in the interim.