Forgejo v11.0.7 contains critical security fixes. Originally scheduled for 7 November, the release date of these patches was advanced because a vulnerability had been leaked publicly.

### Vulnerability (**Critical**): prevent writing to out-of-repo symlink destinations while evaluating template repos
- [CVSS 9.5 Critical](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- [Patch](https://codeberg.org/forgejo/forgejo/commit/328a0b4b217ba00418815ef6e7ed3722415d985b)

When creating a repository based upon a template repository, Forgejo reads the contents of the template repository files, expands variables within the file content, and writes a new file for use in the newly created repository. In the event that the template repository file was a symlink to a file outside of the repository, Forgejo would follow this symlink to read, expand content, and write to the target of the symlink.

This can be exploited to cause corruption to files on the Forgejo server or container that the server process has write access to.

In specific configurations, it is possible to exploit this vulnerability to gain remote shell access to a Forgejo server.  Specifically, remote shell access can be achieved if:
- The paths of sensitive files are known or guessable to an attacker,
- Git access is available through ssh,
- Forgejo provides ssh access through an `authorized_keys` file, which means:
    - The internal ssh server is not used; `[server].START_SSH_SERVER=false`, which is a default.
    - Forgejo manages an `authorized_keys` file; `[server].SSH_CREATE_AUTHORIZED_KEYS_FILE=true`, which is a default.
- And, an attacker can craft the necessary repositories.

The creation of repositories based upon template repositories is being fixed by sandboxing the file access to within the newly created repository, preventing any known symlink or path traversal attack.


### Vulnerability (**Medium**): prevent .forgejo/template from being out-of-repo content
- [CVSS 6.9 Medium](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L)
- [Patch](https://codeberg.org/forgejo/forgejo/commit/bd89c7f92b87d6df1e48d9595e899072daa0e4d9)

When creating a repository based upon a template repository, Forgejo reads the contents of the `.forgejo/template` (or `.gitea/template`) file in the repository in order to identify which files are to be templated content.  In the event that the `.forgejo/template` file was a symlink to a file outside of the repository, Forgejo would follow this symlink to read this file.  This can be exploited to cause resource exhaustion in the Forgejo server, affecting service availability.

This issue is fixed by sandboxing the file access to within the newly created repository, preventing any known symlink or path traversal attack.


### Vulnerability (**Medium**): return on error if an LFS token cannot be parsed
- [CVSS 6.3 Medium](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
- [Patch](https://codeberg.org/forgejo/forgejo/commit/e3b332fb0e2ff2fdaae8411cd9a91bc268106215)

If [LFS](https://git-lfs.com/) is enabled on a Forgejo instance with `[server].LFS_START_SERVER = true` (this is not the default), it was possible for a user to download LFS files for which the OID is known in advance from a private repository to which they did not have read access. This is fixed by returning on error in case the LFS token is invalid instead of returning an inconsistent state.



### Vulnerability (**Low**): prevent commit API from leaking user's hidden email address on valid GPG signed commits
- [CVSS 2.3 Low](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)
- [Patch](https://codeberg.org/forgejo/forgejo/commit/1808b48a4882411677d2c34f6a09714f6692eece)

When a signed GPG commit is accessed through the `/repos/{owner}/{repo}/git/commits/{sha}` API, the verified commit's author's primary email address is exposed in the `commit.verification.signer.email` field in violation of the author's desire to keep their email address private.

This has been fixed by returning the signature’s identity, rather than the account's private email address, which is consistent with what is stored in the Git repo and returned by `git log`.


### Go 1.25 Upgrade

To provide both the highest confidence in the security of these fixes, as well as to maintain full backwards compatibility with the current Forgejo behaviour, an upgrade to go 1.25 was required in order to use their [path-traversal resistant `os.Root` APIs](https://go.dev/blog/osroot) which had new APIs added in [go 1.25](https://go.dev/doc/go1.25#ospkgos).

We recognize that this is an unfortunate change to make in security patches for major versions, and could be difficult for Forgejo packagers to adapt to.

If necessary, a go 1.24 implementation of these security fixes is also included in this release, and `go.mod` can be patched to use go 1.24.  The go 1.24 implementation carries the same security guarantees, but introduces two known behaviour changes.  These are edge cases in repository template expansion which are unlikely to affect end-users, but unfortunately could not be addressed safely in go 1.24:

- In the event that a template repo has a file path with a substitution in it, and the file mode is executable, the new file in the target repo will not be executable (and the executable file gets removed).
- In the event that a template repo has a file path with a substitution in it, and the file is a symlink to another in-repo file, the old behaviour would have been to write through the symlink to the file and then rename the symlink; the new behaviour is to write a regular file in-place of the symlink and delete the symlink.




<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9848): <!--number 9848 --><!--line 0 --><!--description W2NvbW1pdF0oaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9mb3JnZWpvL2NvbW1pdC8xODA4YjQ4YTQ4ODI0MTE2NzdkMmMzNGY2YTA5NzE0ZjY2OTJlZWNlKSBwcmV2ZW50IGNvbW1pdCBBUEkgZnJvbSBsZWFraW5nIHVzZXIncyBoaWRkZW4gZW1haWwgYWRkcmVzcyBvbiB2YWxpZCBHUEcgc2lnbmVkIGNvbW1pdHM=-->[commit](https://codeberg.org/forgejo/forgejo/commit/1808b48a4882411677d2c34f6a09714f6692eece) prevent commit API from leaking user's hidden email address on valid GPG signed commits<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9848): <!--number 9848 --><!--line 1 --><!--description W2NvbW1pdF0oaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9mb3JnZWpvL2NvbW1pdC8zMjhhMGI0YjIxN2JhMDA0MTg4MTVlZjZlN2VkMzcyMjQxNWQ5ODViKSBwcmV2ZW50IHdyaXRpbmcgdG8gb3V0LW9mLXJlcG8gc3ltbGluayBkZXN0aW5hdGlvbnMgd2hpbGUgZXZhbHVhdGluZyB0ZW1wbGF0ZSByZXBvcw==-->[commit](https://codeberg.org/forgejo/forgejo/commit/328a0b4b217ba00418815ef6e7ed3722415d985b) prevent writing to out-of-repo symlink destinations while evaluating template repos<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9848): <!--number 9848 --><!--line 2 --><!--description W2NvbW1pdF0oaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9mb3JnZWpvL2NvbW1pdC9iZDg5YzdmOTJiODdkNmRmMWU0OGQ5NTk1ZTg5OTA3MmRhYTBlNGQ5KSBwcmV2ZW50IC5mb3JnZWpvL3RlbXBsYXRlIGZyb20gYmVpbmcgb3V0LW9mLXJlcG8gY29udGVudA==-->[commit](https://codeberg.org/forgejo/forgejo/commit/bd89c7f92b87d6df1e48d9595e899072daa0e4d9) prevent .forgejo/template from being out-of-repo content<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9848): <!--number 9848 --><!--line 3 --><!--description W2NvbW1pdF0oaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9mb3JnZWpvL2NvbW1pdC9lM2IzMzJmYjBlMmZmMmZkYWFlODQxMWNkOWE5MWJjMjY4MTA2MjE1KSByZXR1cm4gb24gZXJyb3IgaWYgYW4gTEZTIHRva2VuIGNhbm5vdCBiZSBwYXJzZWQ=-->[commit](https://codeberg.org/forgejo/forgejo/commit/e3b332fb0e2ff2fdaae8411cd9a91bc268106215) return on error if an LFS token cannot be parsed<!--description-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9775): <!--number 9775 --><!--line 0 --><!--description Zml4OiBzdHJpY3QgZXJyb3IgaGFuZGxpbmcgb24gY29ycnVwdGVkIERCIG1pZ3JhdGlvbiB0cmFja2luZyB0YWJsZXM=-->fix: strict error handling on corrupted DB migration tracking tables<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9468) ([backported](https://codeberg.org/forgejo/forgejo/pulls/9469)): <!--number 9469 --><!--line 0 --><!--description Zml4OiBwYWNrYWdlIGNsZWFuZWQgcnVsZSBmYWlscyBpZiB0aGUga2VlcCBjb3VudCBpcyB0b28gaGlnaA==-->fix: package cleaned rule fails if the keep count is too high<!--description-->
- Included for completeness but not user-facing (chores, etc.)
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9828): <!--number 9828 --><!--line 0 --><!--description Y2hvcmU6IHVwZGF0ZSBnbyB0YXJnZXQgbGFuZ3VhZ2UgdmVyc2lvbiB0byB2MS4yNS4w-->chore: update go target language version to v1.25.0<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9821): <!--number 9821 --><!--line 0 --><!--description VXBkYXRlIGdvbGFuZyBwYWNrYWdlcyB0byB2MS4yNSAodjExLjAvZm9yZ2VqbykgKG1pbm9yKQ==-->Update golang packages to v1.25 (v11.0/forgejo) (minor)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9826): <!--number 9826 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvb2NpL2FscGluZSBEb2NrZXIgdGFnIHRvIHYzLjIyICh2MTEuMC9mb3JnZWpvKQ==-->Update data.forgejo.org/oci/alpine Docker tag to v3.22 (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9673): <!--number 9673 --><!--line 0 --><!--description Y2hvcmUoZTJlKTogdGVzdCBmbGFraW5lc3MgaW4gd2ViYXV0aG4udGVzdC5lMmUudHMgKCM5NjYyKQ==-->chore(e2e): test flakiness in webauthn.test.e2e.ts (#9662)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9611) ([backported](https://codeberg.org/forgejo/forgejo/pulls/9618)): <!--number 9618 --><!--line 0 --><!--description Y2hvcmUoY2kpOiBsaW1pdCBMREFQIHNlcnZpY2UgY29udGFpbmVyIG1lbW9yeSB1c2FnZSB0byA1MDBN-->chore(ci): limit LDAP service container memory usage to 500M<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8908) ([backported](https://codeberg.org/forgejo/forgejo/pulls/9624)): <!--number 9624 --><!--line 0 --><!--description Y2hvcmU6IFRlc3RQYXJzZUdpdFVSTHMgbXVzdCB1c2UgYSB2YWxpZCBJUHY2IGFkZHJlc3M=-->chore: TestParseGitURLs must use a valid IPv6 address<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9504) ([backported](https://codeberg.org/forgejo/forgejo/pulls/9516)): <!--number 9516 --><!--line 0 --><!--description Zml4OiBhbGxvdyB1bmFjdGl2YXRlZCB1c2VycyB0byBzZW5kIHJlY292ZXJ5IG1haWxz-->fix: allow unactivated users to send recovery mails<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9417) ([backported](https://codeberg.org/forgejo/forgejo/pulls/9418)): <!--number 9418 --><!--line 0 --><!--description Zml4OiB1cGdyYWRlIHRvIHRoZSBsZGFwIHZlcnNpb24gdXNlZCBmb3IgdGVzdGluZyB0byAyLjU=-->fix: upgrade to the ldap version used for testing to 2.5<!--description-->
<!--end release-notes-assistant-->
