Forgejo versions up through 13.0.3 include an attachment component that accepts user uploads. An attacker can upload a multi‑gigabyte file as an issue or release attachment, causing the application to consume excessive disk and memory resources. This resource exhaustion leads to a denial of service for all users. The weakness is characterized by CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Allocation of Resources without Limits).

The vulnerability affects the Forgejo source‑code collaborative platform. No explicit vendor or product name list is provided; the only version information available identifies affected releases as up to and including 13.0.3. Users of later versions are not known to be impacted.

The CVSS base score is 6.5, placing the issue in the moderate severity range. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack is inferred to require authenticated access to create an attachment, as uploads are typically performed by logged‑in users. The lack of a publicly documented exploit and the low exploitation probability suggest a modest but tangible risk to systems that allow large file uploads without size restrictions.