{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /api/v1/repos/{owner}/{repo}/generate (repository creation from a template repository via the Forgejo web/API workflow)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker",
    "codeberg.org/forgejo/forgejo:16.0.3-rootless",
    "forgejo web (sqlite3)",
    "git-over-HTTP push",
    "template expansion (services/repository/generate_repo_commit.go)",
    "git init + git commit"
  ],
  "target_identity": {
    "repository_url": "https://codeberg.org/forgejo/forgejo.git",
    "commit_sha": "eccddb2d17c93b42b2c8995725e03e549ac9ec0c",
    "target_digest": "sha256:214f4ae63ee78be1e445e58573c88dc7215e72091210852e0df94eaac1a25685",
    "runtime_digest": "sha256:214f4ae63ee78be1e445e58573c88dc7215e72091210852e0df94eaac1a25685",
    "platform": "linux",
    "architecture": "x86_64",
    "fixed_control": {
      "image": "codeberg.org/forgejo/forgejo:16.0.4-rootless",
      "digest": "sha256:a263a1298e89e0bdf019005ce1927e9aadaa8f1bd2a94a3e66ad94e2a89e19ce",
      "commit_sha": "6e56b5ebad3fb05036b1ff68a6b47b80f5859c7c"
    }
  },
  "proof_artifacts": [
    "logs/vuln-1/http_generate_request.txt",
    "logs/vuln-1/http_generate_response.json",
    "logs/vuln-1/http_generate_status.txt",
    "logs/vuln-1/marker.txt",
    "logs/vuln-1/rce_id.txt",
    "logs/vuln-1/hostdata_etc_passwd.txt",
    "logs/vuln-1/generated_readme.txt",
    "logs/vuln-1/http_create_repo_status.txt",
    "logs/vuln-1/http_mark_template_status.txt",
    "logs/vuln-1/template_tree.txt",
    "logs/vuln-1/forgejo_service.log",
    "logs/vuln-2/http_generate_request.txt",
    "logs/vuln-2/http_generate_response.json",
    "logs/vuln-2/http_generate_status.txt",
    "logs/vuln-2/marker.txt",
    "logs/vuln-2/rce_id.txt",
    "logs/vuln-2/hostdata_etc_passwd.txt",
    "logs/vuln-2/generated_readme.txt",
    "logs/vuln-2/http_create_repo_status.txt",
    "logs/vuln-2/http_mark_template_status.txt",
    "logs/vuln-2/template_tree.txt",
    "logs/vuln-2/forgejo_service.log",
    "logs/fixed-1/http_generate_request.txt",
    "logs/fixed-1/http_generate_response.json",
    "logs/fixed-1/http_generate_status.txt",
    "logs/fixed-1/marker.txt",
    "logs/fixed-1/rce_id.txt",
    "logs/fixed-1/hostdata_etc_passwd.txt",
    "logs/fixed-1/generated_readme.txt",
    "logs/fixed-1/http_create_repo_status.txt",
    "logs/fixed-1/http_mark_template_status.txt",
    "logs/fixed-1/template_tree.txt",
    "logs/fixed-1/forgejo_service.log",
    "logs/fixed-2/http_generate_request.txt",
    "logs/fixed-2/http_generate_response.json",
    "logs/fixed-2/http_generate_status.txt",
    "logs/fixed-2/marker.txt",
    "logs/fixed-2/rce_id.txt",
    "logs/fixed-2/hostdata_etc_passwd.txt",
    "logs/fixed-2/generated_readme.txt",
    "logs/fixed-2/http_create_repo_status.txt",
    "logs/fixed-2/http_mark_template_status.txt",
    "logs/fixed-2/template_tree.txt",
    "logs/fixed-2/forgejo_service.log"
  ],
  "artifact_sha256": {
    "logs/vuln-1/http_generate_request.txt": "53cb6aa01443dcc4b5375f738ec9ecc463033f8dffe849b24cea67c9cd653986",
    "logs/vuln-1/http_generate_response.json": "2d0219b5e6a9b318aa49917ada378048c78f789263f695a6acc2e1dc95374b5c",
    "logs/vuln-1/http_generate_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/vuln-1/marker.txt": "a0678a46305800ae7af2bec1ea4589df5760c6f78aebe92c00f2b1c57116688a",
    "logs/vuln-1/rce_id.txt": "3df0418c2d4045aa1887d30a921731898d210915886797462ca849d4b204635e",
    "logs/vuln-1/hostdata_etc_passwd.txt": "d070048e99356dd5be1c30167aa6f782c150b3e706747e06374ebd0357bb801b",
    "logs/vuln-1/generated_readme.txt": "b22b009134622b6508d756f1062455d71a7026594eacb0badf81f4f677929ebe",
    "logs/vuln-1/http_create_repo_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/vuln-1/http_mark_template_status.txt": "ce5160732537495c19ec06dc34ff9b20fe246b7e5ba0e5c579285a8db26a5bb5",
    "logs/vuln-1/template_tree.txt": "532c7173d981f9cb0497681f9a0f5d98a7065f77577feaeae08c0dd06d293212",
    "logs/vuln-1/forgejo_service.log": "ccd3375a80f3dca51de805b7c2713a0acb02819e59629a0e0bb3dec158c58107",
    "logs/vuln-2/http_generate_request.txt": "11660f5db43d4f9d2f614e682b42dce3c9e40ccc451364f4bd7bcdd66ba6204c",
    "logs/vuln-2/http_generate_response.json": "aebf63f1b05759fc7220e40d7c172d5e860b5fad59bbc1471768d4d592b38473",
    "logs/vuln-2/http_generate_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/vuln-2/marker.txt": "33c606145f569a7d99a8ef2a857d5d4110700b6a3ca2da5c850c8a9cd680a595",
    "logs/vuln-2/rce_id.txt": "3df0418c2d4045aa1887d30a921731898d210915886797462ca849d4b204635e",
    "logs/vuln-2/hostdata_etc_passwd.txt": "d070048e99356dd5be1c30167aa6f782c150b3e706747e06374ebd0357bb801b",
    "logs/vuln-2/generated_readme.txt": "b22b009134622b6508d756f1062455d71a7026594eacb0badf81f4f677929ebe",
    "logs/vuln-2/http_create_repo_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/vuln-2/http_mark_template_status.txt": "ce5160732537495c19ec06dc34ff9b20fe246b7e5ba0e5c579285a8db26a5bb5",
    "logs/vuln-2/template_tree.txt": "5f4cf21fbe49873d660d84ed3046f3e869d0884dba790f79539e96027b43a055",
    "logs/vuln-2/forgejo_service.log": "5b48bb56a3f1ee6bef4d7fb33ee0229246cadbfe490214fb56dfe6ce106fe3f2",
    "logs/fixed-1/http_generate_request.txt": "2be27db81772d2b9f0ba497aeaac6909e55944a4b4f69af19c95fa56ae7c359c",
    "logs/fixed-1/http_generate_response.json": "17cdd65c960d119629f57093bd7c95dbc2067ba0bdbcae96d411425525fbb69e",
    "logs/fixed-1/http_generate_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/fixed-1/marker.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-1/rce_id.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-1/hostdata_etc_passwd.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-1/generated_readme.txt": "b22b009134622b6508d756f1062455d71a7026594eacb0badf81f4f677929ebe",
    "logs/fixed-1/http_create_repo_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/fixed-1/http_mark_template_status.txt": "ce5160732537495c19ec06dc34ff9b20fe246b7e5ba0e5c579285a8db26a5bb5",
    "logs/fixed-1/template_tree.txt": "2fa9a4abb32224d97d448bf0bd2c01c53b98f797a465b17541b6196b95379804",
    "logs/fixed-1/forgejo_service.log": "ccd84963a178db2e96f2157d84aa220babf1ff2b2121f9f6a5a144eec5dbb4a1",
    "logs/fixed-2/http_generate_request.txt": "f844f24c3058b35abcfd7cad09bca12ea87fe1666ae6e482ee1337f05440b7e2",
    "logs/fixed-2/http_generate_response.json": "4f87bfa08c1802873a74e06a3c41b47f618b1e83f8c4b4f6deeb0fc97930b126",
    "logs/fixed-2/http_generate_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/fixed-2/marker.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-2/rce_id.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-2/hostdata_etc_passwd.txt": "f7b5a17bcb8e1d0f74e9d70ebb7a328b181ed471635e0080ed1e02d528174b4e",
    "logs/fixed-2/generated_readme.txt": "b22b009134622b6508d756f1062455d71a7026594eacb0badf81f4f677929ebe",
    "logs/fixed-2/http_create_repo_status.txt": "024e475b51184d581aa78d15f239ae174124a876281db5581f427de3f5fd55cd",
    "logs/fixed-2/http_mark_template_status.txt": "ce5160732537495c19ec06dc34ff9b20fe246b7e5ba0e5c579285a8db26a5bb5",
    "logs/fixed-2/template_tree.txt": "c997cad54635a34eecc56df5df0579fafe68f5b1bcd9cf64770ad253c8f9c1c2",
    "logs/fixed-2/forgejo_service.log": "b811b87f71488fe0343ee0c289850711e37479a96a0d82a06a08b137710b65df"
  },
  "notes": "CVE-2026-89094 confirmed via real Forgejo containers. Malicious template repo recreates .git/config during variable expansion; repo-local core.hooksPath=.ghooks (overriding forgejo's global core.hooksPath) plus a post-commit hook executes attacker commands as the forgejo runtime user during the template-generated repository's initial commit. Vulnerable 16.0.3 marker present: vuln1=true vuln2=true; fixed 16.0.4 marker absent: fixed1=false fixed2=false. Fixed builds still generate the repository normally (README.md == 'Hello!')."
}