CVE-2026-58420

CVE-2026-58420 affects Gitea: Local File Inclusion via file:// URI in Migration Restore. The vulnerability arises when restore-repo processes release.yml from a user-supplied archive and passes asset.DownloadURL to uri.Open() without validating the URL scheme. Since uri.Open() treats file:// URIs...