CVE-2026-58420

Name of the Vulnerable Software and Affected Versions Gitea versions 1.22.x and earlier

Description A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The DownloadURL field in release attachments is passed to the uri.Open() function without scheme validation. Since uri.Open() supports the file:// scheme via os.Open(), an attacker with operator-level access can use a crafted release.yml to exfiltrate arbitrary files accessible to the Gitea process user from the server filesystem. These files are then stored as release attachments and can be retrieved via the Gitea API. The issue is rooted in the uri.Open() function within modules/uri/uri.go and its invocation in services/migrations/gitea uploader.go.

Recommendations Update Gitea to a version later than 1.22.x. In services/migrations/gitea uploader.go, validate that the DownloadURL scheme is restricted to http or https before calling uri.Open(). As a temporary workaround, restrict the execution of the restore-repo command to fully trusted operators and manually audit archive contents before restoration.