CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

EUVD-2026-58156

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

The vulnerabilities of the functions UploadIssueAttachment() and UploadReleaseAttachment() in the software for creating self-managed Git repositories Gogs allow a malicious actor to trigger a service failure and execute arbitrary code.

The vulnerability of the UploadIssueAttachment and UploadReleaseAttachment functions of the Gogs self-managed Git repository creation tool is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor to cause service failures and execute arbitrary code by...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the UploadIssueAttachment and UploadReleaseAttachment functions, over the /issues/attachments and /releases/attachments endpoints. This is only exploitable if the RequireSigninView setting is disabled, which it...