https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:04:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352793 EUVD-2026-352793 https://cve.radiocsirt.org/vuln/euvd-2026-352793 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58428 <p>Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)</p> <p>Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58428 https://cve.radiocsirt.org/vuln/ghsa-25gq-j9jx-43pg <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOUT calling `upload.Verify` against `setting.Repository.Release.AllowedTypes`. The parent CVE-2025-68939 fix (PR #32151) added the equivalent `upload.Verify` call on the API edit endpoints via `attachment_service.UpdateAttachment`. The web release edit path was not updated.</p> <p>A user with repository write permission can rename any existing release attachment to a name with a forbidden extension via the web release edit form, bypassing the operator-configured allowlist.</p> <p>## Details</p> <p>### Vulnerable code</p> <p>`routers/web/repo/release.go:597` `EditReleasePost`:</p> <p>```go const editPrefix = &#34;attachment-edit-&#34; editAttachments := make(map[string]string) if setting.Attachment.Enabled { for k, v := range ctx.Req.Form { if strings.HasPrefix(k, editPrefix) { editAttachments[k[len(editPrefix):]] = v[0] } } } ... if err = release_service.UpdateRelease(ctx, ctx.Doer, ctx.Repo.GitRepo, rel, addAttachmentUUIDs, delAttachmentUUIDs, editAttachments); err != nil { ctx.ServerError(&#34;UpdateRelease&#34;, err) return } ```</p> <p>`services/release/release.go:321` -- the unvalidated write:</p> <p>```go for uuid, newName := range editAttachments { if !deletedUUIDs.Contains(uuid) {…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOUT calling `upload.Verify` against `setting.Repository.Release.AllowedTypes`. The parent CVE-2025-68939 fix (PR #32151) added the equivalent `upload.Verify` call on the API edit endpoints via `attachment_service.UpdateAttachment`. The web release edit path was not updated.</p> <p>A user with repository write permission can rename any existing release attachment to a name with a forbidden extension via the web release edit form, bypassing the operator-configured allowlist.</p> <p>## Details</p> <p>### Vulnerable code</p> <p>`routers/web/repo/release.go:597` `EditReleasePost`:</p> <p>```go const editPrefix = &#34;attachment-edit-&#34; editAttachments := make(map[string]string) if setting.Attachment.Enabled { for k, v := range ctx.Req.Form { if strings.HasPrefix(k, editPrefix) { editAttachments[k[len(editPrefix):]] = v[0] } } } ... if err = release_service.UpdateRelease(ctx, ctx.Doer, ctx.Repo.GitRepo, rel, addAttachmentUUIDs, delAttachmentUUIDs, editAttachments); err != nil { ctx.ServerError(&#34;UpdateRelease&#34;, err) return } ```</p> <p>`services/release/release.go:321` -- the unvalidated write:</p> <p>```go for uuid, newName := range editAttachments { if !deletedUUIDs.Contains(uuid) {…</p> https://cve.radiocsirt.org/vuln/ghsa-25gq-j9jx-43pg https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304