CVE-2026-58420

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420

CVE-2026-58420 affects Gitea: Local File Inclusion via file:// URI in Migration Restore. The vulnerability arises when restore-repo processes release.yml from a user-supplied archive and passes asset.DownloadURL to uri.Open() without validating the URL scheme. Since uri.Open() treats file:// URIs...

CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:32+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-5ggr-2f2h-jmvm...