fkie_cve-2026-58428

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

GHSA-25gq-j9jx-43pg — Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Affected: Go: code.gitea.io/gitea

## Summary

The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOUT calling `upload.Verify` against `setting.Repository.Release.AllowedTypes`. The parent CVE-2025-68939 fix (PR #32151) added the equivalent `upload.Verify` call on the API edit endpoints via `attachment_service.UpdateAttachment`. The web release edit path was not updated.

A user with repository write permission can rename any existing release attachment to a name with a forbidden extension via the web release edit form, bypassing the operator-configured allowlist.

## Details

### Vulnerable code

`routers/web/repo/release.go:597` `EditReleasePost`:

```go const editPrefix = "attachment-edit-" editAttachments := make(map[string]string) if setting.Attachment.Enabled { for k, v := range ctx.Req.Form { if strings.HasPrefix(k, editPrefix) { editAttachments[k[len(editPrefix):]] = v[0] } } } ... if err = release_service.UpdateRelease(ctx, ctx.Doer, ctx.Repo.GitRepo, rel, addAttachmentUUIDs, delAttachmentUUIDs, editAttachments); err != nil { ctx.ServerError("UpdateRelease", err) return } ```

`services/release/release.go:321` -- the unvalidated write:

```go for uuid, newName := range editAttachments { if !deletedUUIDs.Contains(uuid) {…

Most recent entries from all

bdu:2026-15778

fkie_cve-2026-58428

GHSA-25gq-j9jx-43pg — Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)