CVE-2026-58428

26th percentile - higher than 26% of all known CVEs

The vulnerability allows bypassing the release attachment extension allowlist via the web release edit form. This is a variant of CVE-2025-68939.

Risk of uploading malicious files with disallowed extensions, potentially leading to code execution or malware distribution.

Apply the vendor-provided patch and consider additional server-side extension validation.