CVE-2026-28737: Gitea 1.25 Stored XSS in 3D File Viewer

Technical summary

The vulnerability stems from insufficient sanitization of the extensionsRequired field in glTF files before rendering them in Gitea's 3D file viewer. glTF is a standard 3D asset format that includes metadata fields like extensionsRequired. When the viewer renders these files, it does not properly escape or validate the content of this field, allowing embedded JavaScript to execute in the user's browser. Because the malicious content is stored in the repository file itself, it qualifies as a stored XSS rather than a reflected vulnerability. The attack requires the attacker to have write access to the repository (Pull Request contributor or direct commit access), but the impact affects any user viewing the file, regardless of their privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects network accessibility, low attack complexity, low privilege requirement, required user interaction (the victim must view the file), and cross-site scope (the script runs in the Gitea application context).

Business impact

For organizations using Gitea to manage source code and design assets, this vulnerability creates a supply-chain risk within the repository itself. A malicious contributor—whether an insider or external collaborator with push access—can inject XSS payloads that compromise the security posture of all developers and maintainers who review or interact with 3D models. Potential impacts include theft of session tokens, API keys exposed in local storage, account takeover of high-privilege users, lateral movement to other systems if Gitea is part of an integrated CI/CD pipeline, and damage to trust in the repository as a secure collaboration platform. Teams storing 3D assets (CAD, game models, visualization data) are particularly exposed. The stored nature of the attack means the malicious file remains a persistent threat until explicitly removed.

Affected systems

Gitea versions 1.25.0 through 1.25.x are affected. Version 1.26.0 and later have addressed this issue. Organizations running self-hosted Gitea instances in this version range should prioritize assessment and patching. The vulnerability does not affect other Git platforms (GitHub, GitLab, Gitea instances outside the affected version range) or users who do not upload or view glTF files.

Exploitability

Exploitation requires repository write access, which is a moderate barrier but not uncommon in collaborative environments. An attacker must craft a glTF file with a malicious extensionsRequired field and commit or push it to a repository where the target user has access. The attack is reliable once the file is in place—any user viewing it in Gitea's 3D viewer will trigger the XSS without additional user interaction beyond opening the file. No special knowledge of glTF format internals is required; the extensionsRequired field is a standard, documented part of the glTF specification. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of the attack and the ease of weaponizing a 3D file means exploitation could accelerate once awareness spreads.

Remediation

Upgrade Gitea to version 1.26.0 or later, which includes proper sanitization of the extensionsRequired field in glTF rendering. In the interim, organizations can reduce risk by restricting who can push to repositories containing 3D assets, disabling the 3D file viewer if it is not essential, or auditing repositories for suspicious glTF files. Users should avoid viewing 3D files from untrusted sources within Gitea until patched.

Patch guidance

Update Gitea from 1.25.x to 1.26.0 or the latest stable release. Verify the update against the official Gitea release notes and advisories to confirm the fix is included. Most Gitea deployments can be upgraded by downloading the new binary or container image and restarting the service; however, test the upgrade in a non-production environment first to ensure compatibility with custom plugins or configurations. Check your Gitea installation's version number via the web interface (settings > version) or command line (gitea --version) before and after patching.

Detection guidance

Audit repositories for glTF files (.glb, .gltf extensions) committed in the past month, especially those from external contributors or in branches that may have been merged into main. Review the Gitea access logs for unusual viewing patterns of 3D files—an attacker may test the payload by viewing it themselves first. Monitor for any session hijacking or unauthorized API calls immediately following the discovery of 3D file uploads. If you suspect exploitation, review browser console logs and network traffic on affected machines for unexpected JavaScript execution or exfiltration attempts. Search version control history for extensionsRequired fields containing script tags or event handlers using grep or similar tools.

Why prioritize this

This vulnerability merits prompt attention because it combines high CVSS severity (8.7), stored XSS capability, and supply-chain implications within trusted repositories. Unlike reflected XSS, which requires social engineering to deliver, stored XSS in a repository is automatic and affects all viewers. The requirement for write access limits the immediate blast radius to organizations with collaborative push policies, but such policies are common in development teams. The lack of KEV listing and relative newness (published July 2026) mean many organizations may not yet be aware.

Risk score, explained

The CVSS score of 8.7 (HIGH) reflects the confluence of high confidentiality and integrity impacts, network attack vector, low attack complexity, and low privilege requirements. The low attack complexity and network vector ensure widespread exploitability in networked Gitea instances. Integrity impact is high because an attacker can modify user sessions, inject malicious data, or alter the perceived trustworthiness of the repository. Confidentiality impact is high due to potential exfiltration of tokens and sensitive data present in the page context. Availability is not affected (the attack does not crash the service or deny access). The requirement for user interaction (UI:R) and low privilege (PR:L) prevent a higher score; however, the cross-site scope (S:C) increases impact because the XSS runs within the Gitea application context with full privileges of the viewing user.

Frequently asked questions