CVE-2026-113429 Details
Description
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types.
A stored cross-site scripting vulnerability has been identified in Gitea's legacy Actions artifact uploads, specifically in versions through 28.2.0. The issue arises because the v1 to v3 artifact uploads stored the `Content-Encoding` header without proper validation. This header was then served as the `Content-Type` during artifact downloads. If the `Content-Encoding` value began with `video/` or `audio/`, it also removed the sandboxing Content-Security-Policy. As a result, a user capable of running an Actions job could upload an artifact that, when downloaded via a direct URL, was rendered as HTML on the Gitea origin. This scenario is accessible anonymously on public repositories. If a victim opened the link, the attacker's script would execute in their session, potentially allowing an administrator to gain control of the instance.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been patched. Instructions for downloading the latest version are available on the Gitea releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39855 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39996 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-9v6p-xpcp-7488 | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |