CVE-2026-58428: Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
The web handler EditReleasePost (routers/web/repo/release.go) reads form fields with prefix attachment-edit-{uuid} into a map[uuid]newName, passes that map to release_service.UpdateRelease, which writes the new name to the database via repo_model.UpdateAttachmentByUUID WITHOUT calling upload.Verify against setting.Repository.Release.AllowedTypes. The parent CVE-2025-68939 fix (PR #32151) added the equivalent upload.Verify call on the API edit endpoints via attachment_service.UpdateAttachment. The web release edit path was not updated.
A user with repository write permission can rename any existing release attachment to a name with a forbidden extension via the web release edit form, bypassing the operator-configured allowlist.
References
- github.com/advisories/GHSA-25gq-j9jx-43pg
- github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
- github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
- github.com/go-gitea/gitea/pull/38406
- github.com/go-gitea/gitea/pull/38426
- github.com/go-gitea/gitea/releases/tag/v1.27.0
- github.com/go-gitea/gitea/security/advisories/GHSA-25gq-j9jx-43pg
- nvd.nist.gov/vuln/detail/CVE-2026-58428
Code Behaviors & Features
Detect and mitigate CVE-2026-58428 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →