CVE-2026-58428

CVE-2026-58428 relates to Gitea: a web release edit form bypasses the release attachments allowlist, enabling a rename to forbidden extensions (e.g., .exe) via the web UI. The root cause is that the web path EditReleasePost updates attachments without running upload.Verify against Repository.Rele...