CVE-2025-68937: Forgejo RCE Vulnerability

CVE-2025-68937 Overview

CVE-2025-68937 is a critical symlink attack vulnerability in Forgejo, a self-hosted Git forge software. The vulnerability allows attackers to write to unintended files and potentially obtain server shell access through mishandling of out-of-repository symlink destinations when processing template repositories. This flaw stems from improper UNIX symbolic link following (CWE-61), enabling path traversal beyond intended repository boundaries.

Critical Impact

Attackers can exploit this vulnerability to write arbitrary files on the server and potentially achieve remote code execution, compromising the entire Forgejo instance and underlying infrastructure.

Affected Products

• Forgejo versions prior to 13.0.2
• Forgejo 11 LTS versions prior to 11.0.7
• Gitea versions prior to 1.24.7 (related vulnerability)

Discovery Timeline

• 2025-12-26 - CVE-2025-68937 published to NVD
• 2025-12-29 - Last updated in NVD database

Technical Details for CVE-2025-68937

Vulnerability Analysis

This vulnerability exists in Forgejo's template repository handling mechanism. When a user creates a new repository from a template, the system copies files from the template repository to the new repository. The flaw occurs because the application fails to properly validate or sanitize symbolic links within template repositories that point to destinations outside the repository directory structure.

An attacker who can create or control a template repository can craft malicious symlinks that, when followed during the repository creation process, allow writing to arbitrary locations on the server's filesystem. This represents a classic UNIX symlink following vulnerability where the application trusts user-controlled symlink targets without proper boundary validation.

The severity of this vulnerability is amplified by the potential for achieving server shell access, indicating that attackers could potentially overwrite critical configuration files, inject malicious code into executable locations, or compromise SSH keys and other authentication mechanisms.

Root Cause

The root cause is improper handling of symbolic links in the template repository copying mechanism. The application follows symlinks during file operations without verifying that the resolved destination path remains within the expected repository boundaries. This allows out-of-repository symlink destinations to be dereferenced, enabling arbitrary file writes through path traversal.

Attack Vector

The attack leverages network-accessible Forgejo functionality to exploit template repositories. An attacker would craft a template repository containing symbolic links that point to sensitive locations outside the repository directory (e.g., /etc/passwd, application configuration files, or web-accessible directories). When a victim or the attacker creates a new repository using this malicious template, the symlinks are followed, and file contents are written to the attacker-specified locations.

The exploitation flow involves:

1. Creating a template repository with malicious symlinks pointing outside the repository root
2. Adding file content that should be written to the symlink destination
3. Triggering repository creation from the malicious template
4. The server follows the symlink and writes content to the unintended destination

Detection Methods for CVE-2025-68937

Indicators of Compromise

• Unexpected symbolic links in template repositories pointing to system paths (e.g., /etc/, /var/, /home/)
• Unusual file modifications on the server outside of repository directories
• Template repositories containing symlinks with absolute paths or excessive parent directory references (../)
• Unauthorized modifications to server configuration files or SSH authorized_keys

Detection Strategies

• Monitor file system operations for writes originating from the Forgejo process to directories outside repository storage paths
• Implement audit logging for template repository creation and usage events
• Scan existing template repositories for symbolic links with suspicious destinations
• Deploy file integrity monitoring (FIM) on critical system directories

Monitoring Recommendations

• Enable and review Forgejo application logs for template repository operations
• Monitor server file system changes using tools like auditd or OSSEC
• Implement alerting for any file modifications in sensitive directories attributed to the Forgejo service account
• Review newly created template repositories for symbolic link content

How to Mitigate CVE-2025-68937

Immediate Actions Required

• Upgrade Forgejo to version 13.0.2 or later immediately
• For organizations running Forgejo 11 LTS, upgrade to version 11.0.7 or later
• Audit existing template repositories for malicious symbolic links
• Consider temporarily disabling template repository functionality until patching is complete

Patch Information

Forgejo has released security patches addressing this vulnerability. Organizations should update to the following versions:

• Forgejo 13.x: Update to version 13.0.2 or later - See Forgejo Release Notes 13.0.2
• Forgejo 11 LTS: Update to version 11.0.7 or later - See Forgejo Release Notes 11.0.7
• Gitea users: A related fix is available in version 1.24.7 - See Gitea Release Announcement

Additional security information is available in Forgejo Security Issue #43.

Workarounds

• Restrict template repository creation permissions to trusted administrators only
• Implement server-side restrictions preventing the Forgejo process from writing outside designated repository directories
• Use containerization or sandboxing to limit the impact of potential exploitation
• Deploy filesystem access controls (SELinux, AppArmor) to restrict the Forgejo service account

# Example: Restrict Forgejo service with AppArmor profile
# Add to /etc/apparmor.d/forgejo
# Deny writes outside repository directories
deny /etc/** w,
deny /var/www/** w,
deny /home/*/.ssh/** w,
# Allow only designated repository storage
/var/lib/forgejo/repositories/** rwk,