The vulnerability exists in Forgejo's restore-repo feature, where a crafted asset path in a dump’s release.yml can use path traversal to read files outside the dump directory. This flaw allows an attacker who can supply a dump to an administrator to access sensitive files, such as the app.ini configuration file, leading to disclosure of credentials or configuration. The weakness is a classic path traversal (CWE-22).

Versions up to 15.0.11, 16.0.7, and 17.0.1 of the Forgejo project are impacted. The affected vendor is Forgejo (forgejo.org). Administrators who use restore-repo in these releases are potentially at risk. No patch version is specified in the provided data; users should consult the Forgejo repository for an update beyond the stated releases.

The CVSS score is 6.8, indicating moderate severity. The EPSS score is unavailable, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread known exploitation at this time. The attack requires someone to create or supply a malicious dump and have the restore operation performed by a privileged administrator; thus, the exploitation vector is likely administrative access or social engineering to trigger a restore. If such conditions are met, the attacker could read arbitrary files from the host.