The vulnerability (CVE-2026-58428) exists in Gitea's web release edit handler (EditReleasePost in routers/web/repo/release.go) where form fields for renaming attachments are processed and updated in the database without verifying the new file extension against the configured allowed types. The API path was fixed previously (CVE-2025-68939) to enforce extension validation via upload.Verify, but the web path was not updated accordingly. This allows a user with repository write permission to rename an existing release attachment to a forbidden extension via the web release edit form, bypassing the operator-configured allowlist. The vulnerability was confirmed in Gitea v1.26.1 with a proof of concept demonstrating that the API rejects forbidden extensions while the web form accepts them without error.

An attacker with repository write permissions can rename release attachments to disallowed file extensions, potentially enabling distribution of malicious files under extensions that operators intended to block. This bypass undermines the operator-configured extension allowlist for release attachments, increasing the risk of malicious payload delivery through release assets. The impact is limited to users with write access to the repository and does not affect confidentiality or availability directly. The CVSS vector indicates no confidentiality or availability impact but high integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, operators should be aware that the web release edit form does not enforce the allowed file extension restrictions. As a temporary mitigation, restrict repository write permissions to trusted users only and monitor release attachments for unauthorized file extensions. Review vendor advisories for updates and apply official patches once available.