Gitea before version 1.27.0 contains a security flaw in its web release edit form where users with repository write permissions can rename release attachments to file extensions that are disallowed by the operator-configured allowlist. This happens because the web handler for editing releases fails to validate the file extensions against the allowed types before updating the database, unlike the API endpoint which performs this validation. This discrepancy allows an attacker to bypass the release attachment extension restrictions configured by the operator through the web interface, potentially leading to the upload or use of disallowed file types.

The vulnerability allows users with repository write permissions to bypass configured restrictions on release attachment file extensions via the web interface. While it does not directly impact confidentiality or availability, it can lead to integrity issues by allowing disallowed file types to be associated with releases. This could facilitate the distribution of malicious or unauthorized files within the repository context.

A patch is available that fixes this issue by ensuring the web release edit form validates attachment file extensions against the allowlist before updating the database. Users should upgrade to Gitea version 1.27.0 or later to remediate this vulnerability.