CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-58428

CVE-2026-58428 : Release attachment extension allowlist bypass via the web release edit form in Gitea (variant of CVE-2025-68939). Connected sources confirm the issue and cite a fix in the Gitea 1.27.0 release tag. The initial documents do not specify exact affected versions or root cause details...

EUVD-2026-58156

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2025-68939

creationtimestamp| type| source ---|---|--- 2025-12-26 05:08:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maujlui74e2g 2026-01-02 21:53:02+00:00| published-proof-of-concept| Telegram/79M2PUWRnDZFfaBX3deh-SQz72WULa4jlHjBh-ox2wjl5as...

CVE-2025-68939

Issue : Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via the attachment API. Affected component : attachment handling API in Gitea. Root cause : insufficient validation in attachment editing APIs that permits disallowed exten...

CVE-2025-68939

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...