CVE-2026-58420

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420

CVE-2026-58420 covers a Local File Inclusion (LFI) in Gitea’s Migration Restore. The vulnerability arises because the restore path feeds user-supplied asset.DownloadURL directly into a helper that supports both http/https and file:// schemes, with no validation to restrict to HTTP(S). An attacker...

CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:32+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-5ggr-2f2h-jmvm...