Conciser: User's who can create new repositories, can exploit templates to do variable template expansion leading to being able to read arbitrary data from the Forgejo hosts.

If you have open registrations or otherwise users you don't 100% trust with the ability to create new repository (which is the default I think?), they could potentially exploit this and you probably wanna upgrade ASAP.

If you have only trusted users, or single user, seems it's fine. Of course, wanna upgrade anyway to not add escalation paths, but in the other situation it's graver.

> To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized.

What happened to sandboxing the offending git invocation?