CVE-2026-103667

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103667

EUVD

EUVD-2026-93910

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea's container registry serving blob downloads with a Content-Type header derived from the media type in pushed image manifests. Since there is no Content-Disposition header or restrictive content security policy, an attacker who can push container images can upload HTML and JavaScript content labeled as text/html. When a victim accesses this URL while authenticated, the script executes in the browser under Gitea's origin, allowing the attacker to perform actions on behalf of the victim, such as creating API tokens.

Detection Guidance

This vulnerability can be detected by checking Gitea's container registry for unexpected HTML or JavaScript content in blob downloads. Inspect network traffic for blob URLs with text/html Content-Type. Review pushed container images for unusual media types. Check Gitea logs for unauthorized API token creation events.

Impact Analysis

If you use Gitea's container registry and an attacker pushes malicious HTML/JavaScript content, visiting the blob URL while logged in could allow the attacker to execute actions as you. This includes creating API tokens or performing other unauthorized actions on your behalf, potentially leading to account compromise or data theft.

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts and data, violating confidentiality and integrity requirements under GDPR and HIPAA. If exploited, it may result in data breaches, unauthorized processing of personal data, or failure to maintain secure access controls, potentially leading to regulatory penalties or fines.

Mitigation Strategies

Update Gitea to the latest version that patches this issue. Disable the container registry if not needed. Restrict write access to container images to trusted users only. Implement strict content security policies for blob downloads. Monitor for unauthorized API token creation.

Hi! I’m here to help you understand CVE-2026-103667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70