CVE-2026-58428

Published: Aug 13, 2026Modified: Aug 26, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Related CWEs

Improper Protection of Alternate Path

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://blog.gitea.com/gitea-1.27.0-is-released/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-25gq-j9jx-43pg

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-25gq-j9jx-43pg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.