CVE-2026-58428

Deferred Deferred - Pending Action

Release Attachment Extension Allowlist Bypass via Web Release Edit Form

Publication date: 2026-08-13

Last updated on: 2026-08-26

Assigner: Gitea Limited

Description

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-26

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-58428

EUVD

EUVD-2026-58156

Affected Vendors & Products

Vendor	Product	Version / Range
go-gitea	gitea	to 1.26.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-424	The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

Executive Summary

CVE-2026-58428 is a vulnerability in Gitea affecting versions up to 1.26.4. It allows an attacker with repository write permissions to bypass the configured release attachment extension allowlist via the web release edit form. The issue occurs because the web handler EditReleasePost does not validate file extensions against the Repository.Release.AllowedTypes setting before renaming attachments.

Detection Guidance

Check Gitea versions up to 1.26.4 for vulnerable instances. Review release attachments in repositories with write permissions for unexpected file extensions. Look for files renamed to forbidden extensions via the web release edit form.

Impact Analysis

This vulnerability can lead to malware distribution if an attacker renames a file to a forbidden extension. It may also enable stored XSS attacks through inline-rendered files. Additionally, it defeats the intended security controls set by the operator, allowing malicious file uploads disguised as safe files.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file uploads that may contain malicious content or sensitive data. Attackers could bypass security controls to distribute malware or exfiltrate data, violating data protection and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Gitea to a patched version. Remove the release attachment extension allowlist temporarily. Restrict repository write permissions. Use a reverse proxy to filter malicious form fields. Apply the suggested fix by adding upload.Verify validation in UpdateRelease for web edits.

Hi! I’m here to help you understand CVE-2026-58428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70