Gitea Attachment API File Extension Bypass Vulnerability

A vulnerability in Gitea versions prior to 1.23.0 allows users to upload attachments with disallowed file extensions by manipulating the attachment name through the attachment API. This issue arises because the API did not properly enforce file extension restrictions, enabling the upload of forbidden file types.

Impact

Exploitation of this vulnerability could lead to the upload of malicious files that are not allowed by the server's file extension policies, potentially causing harm if those files are executed or processed by the application.

Reproduction

To reproduce this vulnerability, upload an attachment through the attachment API while editing the attachment name to include a forbidden file extension. The server will accept the upload despite the disallowed extension.

Remediation

Users can update to Gitea version 1.23.0 or later, where this vulnerability has been addressed.