A critical remote code execution vulnerability in Forgejo allows untrusted users to exploit template repository expansion to execute arbitrary processes and read sensitive host data. The flaw occurs when a malicious template injects a .git folder during repository initialization, which the latest security patch addresses by removing the directory before git setup. Administrators with open registrations are urged to upgrade immediately, especially since the issue was previously patched in Gitea but initially missed in the downstream fork.