The vulnerability is an allowlist bypass that lets attackers upload files with disallowed extensions through the web release edit form, leading to arbitrary file uploads that could enable content manipulation or other unauthorized actions. It aligns with CWE-424 (misuse of default or dummy values) and CWE-434 (unrestricted upload of file with dangerous type), and poses risks to confidentiality, integrity, and availability of the Gitea repository.

The issue affects the Gitea Open Source Git Server. The advisory references the 1.27.0 release that implements a fix, implying all earlier releases are vulnerable. No explicit version list is provided, so deployments running any version preceding 1.27.0 should be considered affected.

The CVSS score is 6.5, and the EPSS score is < 1%, but the vulnerability remains potentially exploitable. Based on the description, it is inferred that an attacker would need access to the release edit form, which normally requires authentication. The risk remains significant due to the capacity for unrestricted file uploads, despite the lack of current exploitation data and absence from CISA KEV catalog. Administrators should treat the threat as significant until a patch is applied.