PT-2026-63296 · Gitea · Gitea
CVE-2026-58428
·
Published
2026-07-21
·
Updated
2026-07-22
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea version 1.26.1
Description
A user with repository write permissions can bypass the configured file extension allowlist when renaming release attachments via the web interface. While the API endpoints enforce the
Repository.Release.AllowedTypes restriction, the web handler EditReleasePost in routers/web/repo/release.go fails to call the upload.Verify() function before updating the attachment name in the database via repo model.UpdateAttachmentByUUID(). This allows an attacker to rename a previously uploaded compliant file to a forbidden extension, such as .exe, .html, or .svg. This could be used to distribute malware or host stored Cross-Site Scripting (XSS) attacks if the server renders certain file types inline.Recommendations
Update Gitea to a version where the
UpdateRelease function in services/release/release.go is updated to verify new attachment names against the Repository.Release.AllowedTypes allowlist using upload.Verify() before persisting changes.
As a temporary mitigation, restrict write permissions on repositories that utilize a release allowlist.
As a temporary mitigation, remove the Repository.Release.AllowedTypes allowlist to eliminate the bypass, although this removes the intended security restriction.Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gitea