Skip to main content
cve.nowby Sazabi
← Vulnerabilities
CVE-2026-113429VulnerabilityPublished

Gitea stored XSS through legacy Actions artifact Content-Encoding

Affects Gitea versions before 28.3.0 that use the legacy (v3) Actions artifact upload path. Fixed in Gitea 28.3.0.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Published
Last modified
Published
Not listed in CISA KEV
8/100 · provisional
Specific setups only
Fix
Fixed in 28.3.0
None on Exploit-DB, Metasploit or GitHub

Summary

Gitea, the self-hosted Git service, is affected through its Actions artifact download feature. An attacker who can run a CI job could upload a file that executes malicious scripts in a victim's browser when they open the download link, which could let the attacker take over the victim's account, including an administrator's and therefore the whole Gitea instance.

Read the original description

Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types.

What to do

  • Check whether your setup matches what the bug needs.

    Legacy (v3) Actions artifact upload path is used Content-Encoding value starts with video/ or audio/ (removes the sandbox CSP) Victim must open the direct artifact download URL

  • Upgrade to a fixed version: 28.3.0.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • gitea.dev

    fixed in 28.3.0

Evidence 5

  1. Advisory
  2. Patch
  3. Patch
  4. Repository
  5. Link

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about CVE-2026-113429

What does this mean?

The legacy Actions artifact upload stores the Content-Encoding request header without checking it. When that value starts with video/ or audio/, Gitea also removes the sandbox Content-Security-Policy, so an attacker's JavaScript can run on the Gitea origin when a user opens the direct artifact download URL. The script runs with that user's session, and for an administrator this means control of the instance.Source: github.com

Am I affected, and how do I check?

Gitea versions before 28.3.0 are affected, and the bug needs the legacy (v3) Actions artifact upload path in use with a Content-Encoding value starting with video/ or audio/. The facts do not give a command or setting to confirm whether the v3 upload path is in use, so check the Gitea version and the Actions artifact configuration against these conditions.Source: github.com

What should I do about it?

Upgrade Gitea to 28.3.0 or later, which is the fixed version listed for this vulnerability.Source: github.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data