CVE-2026-58420: Gitea: Local File Inclusion via file:// URI in Migration Restore

July 21, 2026

Gitea’s restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open() without scheme validation. Because uri.Open() supports the file:// scheme via os.Open(), an operator-level attacker can plant a crafted release.yml to exfiltrate arbitrary files from the server filesystem as release attachments.

References

github.com/advisories/GHSA-5ggr-2f2h-jmvm
github.com/go-gitea/gitea/security/advisories/GHSA-5ggr-2f2h-jmvm
nvd.nist.gov/vuln/detail/CVE-2026-58420

Code Behaviors & Features

Detect and mitigate CVE-2026-58420 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →