CVE-2026-58428

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.1

Description A user with repository write permissions can bypass the configured file extension allowlist when renaming release attachments via the web interface. While the API endpoints enforce the Repository.Release.AllowedTypes restriction, the web handler EditReleasePost in routers/web/repo/release.go fails to call the upload.Verify() function before updating the attachment name in the database via repo model.UpdateAttachmentByUUID(). This allows an attacker to rename a previously uploaded compliant file to a forbidden extension, such as .exe, .html, or .svg. This could be used to distribute malware or host stored Cross-Site Scripting (XSS) attacks if the server renders certain file types inline.

Recommendations Update Gitea to a version where the UpdateRelease function in services/release/release.go is updated to verify new attachment names against the Repository.Release.AllowedTypes allowlist using upload.Verify() before persisting changes. As a temporary mitigation, restrict write permissions on repositories that utilize a release allowlist. As a temporary mitigation, remove the Repository.Release.AllowedTypes allowlist to eliminate the bypass, although this removes the intended security restriction.