Labels Milestones

Search syntax

See the documentation for further details on search, operators, and filters.

"forgejo"

Include only results that match the term in quotes

assignee:<username>

Filter by assigned user

author:<username>

Filter by the author

is:all

All

is:closed

Closed

is:open

Open

mentions:<username>

Filter by mentioned user

modified:[>|<]<date>

Filter by last modified date

review:<username>

Filter by user who reviewed

sort:<by>:[asc|desc]

Sort by: created|comments|updated|deadline

Cancel

New issue

0 Open 8 Closed 8 All

Label

Show archived labels

All labels No label

bug

critical

ebook-branch

high

low

main

medium

release-blocker

security

Milestone

All milestones No milestones

Project

All projects No project

Author

All authors

Assignee

All assignees No assignee

jfro

Sort

Relevance Newest Oldest Recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

0 Open 8 Closed 8 All

Label

Clear labels

bug

critical

ebook-branch

high

low

main

medium

release-blocker

security

Milestone

No milestone

Projects

Clear projects

Assignee

Clear assignees

No assignee

jfro

Import upload from the admin page always fails with 400

bug

main

release-blocker

#45 by jfro was closed 2026-10-18 18:21:38 +00:00

Export job file_path is mass-assignable, so deleting the job deletes any file

main

medium

release-blocker

security

#31 by jfro was closed 2026-10-18 17:16:35 +00:00

[medium] Import doesn't import (functional bug)

bug

main

medium

release-blocker

#13 by jfro was closed 2026-10-18 17:07:29 +00:00

[high] OIDC callback trusts state from the query string when the session is missing

high

main

release-blocker

security

#9 by jfro was closed 2026-10-18 17:02:08 +00:00

[high] Admin import/export reachable by any logged-in user (main only)

high

main

release-blocker

security

#8 by jfro was closed 2026-10-18 17:04:30 +00:00

[high] cover_image_key mass assignment → path traversal → arbitrary file delete

high

main

release-blocker

security

#7 by jfro was closed 2026-10-18 17:10:28 +00:00

[high] SSRF via cover_url

high

main

release-blocker

security

#6 by jfro was closed 2026-10-18 16:22:56 +00:00

[critical] Arbitrary server file read via cover_url (local-path branch in download_and_store_cover)

critical

main

release-blocker

security

#5 by jfro was closed 2026-10-18 16:14:54 +00:00