CVE-2026-58428
published 2026-08-13CVE-2026-58428: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.33%
26.2th percentile
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
ghsa5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
ghsa·2026-07-21·CVSS 5.3
CVE-2026-58428 [MEDIUM] CWE-424 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
## Summary
The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOUT calling `upload.Verify` against `setting.Repository.Release.AllowedTypes`. The parent CVE-2025-68939 fix (PR #32151) added the equivalent `upload.Verify` call on the API edit endpoints via `attachment_service.UpdateAttachment`. The web release edit path was not updated.
A user with repository write permission can rename any existing release attachment to a name with a forbidden extensio
Red Hat
code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
vendor_redhat·2026-08-13·CVSS 5.3
CVE-2026-58428 [MEDIUM] CWE-434 code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
A flaw was found in Gitea. An authenticated remote attacker with repository write permission could bypass the attachment extension allowlist via the web release edit form. This vulnerability allows the attacker to rename existing release attachments to forbidden file extensions, potentially leading to the distribution of malicious files or stored Cross-Site Scripting (XSS) attacks.
Statement: The vulnerability, a Moderate attachment allowlist bypass in Gitea, allows an authenticated attacker to upload files with forbidden extensions by manipulating the web release edit form. However, Red Hat products are not
No detection rules found.
No public exploits indexed.
2026-08-13
Published