# Critical remote code execution flaw found in Forgejo up to version 16.0.3

A critical remote code execution vulnerability affects Forgejo, the self-hosted Git forge, in versions 16.0.3 and earlier, according to a report shared on Hacker News. Such flaws let attackers run arbitrary code on a server, so administrators of exposed Forgejo instances should patch or upgrade as soon as a fix is available.

**Importance:** 3/5

## Sources

### Technology
- [Hacker News](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md) — Thu, 10 Sep 2026 15:57:40 +0000