{"api_version":"1","generated_at":"2026-11-15T23:52:23+00:00","cve":"CVE-2026-123065","urls":{"html":"https://cve.report/CVE-2026-123065","api":"https://cve.report/api/cve/CVE-2026-123065.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123065","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123065"},"summary":{"title":"Gitea deletion of arbitrary attachment files through release edit","description":"When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment's UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:18","updated_at":"2026-11-15 22:17:18"},"problem_types":["CWE-22","CWE-639","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4p89-xcq8-xfhm","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4p89-xcq8-xfhm","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40120","name":"https://github.com/go-gitea/gitea/pull/40120","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40268","name":"https://github.com/go-gitea/gitea/pull/40268","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123065","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123065","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.15.0 28.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/HexDump0","lang":"en"},{"source":"CNA","value":"https://github.com/ivantsepp","lang":"en"},{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.4.0","status":"affected","version":"1.15.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/HexDump0"},{"lang":"en","type":"reporter","value":"https://github.com/ivantsepp"},{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment's UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"},{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:14:01.669Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-4p89-xcq8-xfhm","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4p89-xcq8-xfhm"},{"name":"Fix: go-gitea/gitea pull request #40120","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40120"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40268","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40268"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.4.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}],"title":"Gitea deletion of arbitrary attachment files through release edit"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-123065","datePublished":"2026-11-15T21:14:01.669Z","dateReserved":"2026-11-15T20:29:37.615Z","dateUpdated":"2026-11-15T21:14:01.669Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:18","lastModifiedDate":"2026-11-15 22:17:18","problem_types":["CWE-22","CWE-639","CWE-22 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123065","Ordinal":"1","Title":"Gitea deletion of arbitrary attachment files through release edi","CVE":"CVE-2026-123065","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123065","Ordinal":"1","NoteData":"When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment's UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release.","Type":"Description","Title":"Gitea deletion of arbitrary attachment files through release edi"}]}}}