CVE-2026-113429

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Legacy Actions artifact uploads store the Content-Encoding header without validation in the column used as the Content-Type during download. If the value starts with video/ or audio/, the sandboxing Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting) is removed. This allows a user capable of running an Actions job to upload an artifact that a browser renders as HTML when the direct download URL is accessed. On public repositories, these URLs are reachable anonymously. A victim opening the link executes the attacker's script within their own session, which could grant an attacker full control of the instance if the victim is an administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.