CVE-2026-96594

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} fails to include the proper content type and disposition headers when serving files up to 1 KiB stored directly in Git rather than in LFS (Large File Storage). This allows an HTML file committed to a repository to be rendered by the browser on the Gitea origin. Consequently, a user with push access to a repository can execute JavaScript within the session of a victim who opens the media URL, allowing the attacker to perform actions with the victim's permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.