My self-hosted Forgejo instance was compromised through a known vulnerability in an end-of-life release. This is the incident report.