Local File Inclusion via file:// URI in Migration Restore

Executive Summary

CVE-2026-58420 is a Local File Inclusion vulnerability in Gitea affecting versions up to 1.26.4. It allows attackers with admin or operator access to read arbitrary files on the server by exploiting the file:// URI scheme in the migration restore feature. Attackers craft a malicious archive with a release.yml file containing a file:// URL pointing to sensitive files. When processed during repository restoration, the server reads the targeted file and stores it as a release attachment accessible via the Gitea API.

Useful 0 Not Useful 0

Detection Guidance

Check Gitea logs for suspicious restore operations involving file:// URIs. Inspect release attachments for unexpected files. Review admin/operator access logs for unauthorized file reads. Look for archives containing release.yml with file:// URLs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive server files such as /etc/passwd, SSH keys, or configuration files. Attackers with admin or operator privileges can exploit it to steal confidential data, compromise the server, or escalate privileges. The impact includes data breaches, system compromise, and potential lateral movement within the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal or health data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict restore-repo execution to trusted operators only. Manually audit archive contents before restoration. Validate DownloadURL schemes in gitea_uploader.go to block file:// URIs. Temporarily disable migration restore functionality if possible.

Useful 0 Not Useful 0