CVE-2026-28737

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.0 and later

Description Gitea is subject to stored cross-site scripting (XSS) through the built-in 3D file viewer, which utilizes the Online3DViewer library. The issue occurs when a .gltf file contains an unsupported extension within the extensionsRequired variable. The viewer generates an error message containing the name of the unsupported extension, which Gitea then inserts into the Document Object Model (DOM) using innerHTML without proper sanitization. An attacker can push a specially crafted .gltf file to a repository to execute arbitrary JavaScript in the context of any user who views the file. This can lead to full account takeover, including the creation of API access tokens via the /user/settings/applications endpoint, reading private repositories, and modifying repository contents.

Recommendations For Gitea versions 1.25.0 and later, replace the use of innerHTML with textContent when displaying error messages to ensure the content is treated as text rather than HTML. As a mitigation measure, render 3D file previews inside a sandboxed <iframe> with a restrictive Content-Security-Policy (CSP) to limit inline script execution.