CVE-2026-96594

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96594

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Gitea API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} exposing files stored in Git (not LFS) without proper content type or disposition headers. An attacker who can push to a repository can upload an HTML file that gets rendered in a victim's browser when they access the media URL, allowing the attacker to execute JavaScript with the victim's permissions.

Detection Guidance

This vulnerability involves Gitea improperly serving HTML files without proper content type and disposition headers. To detect it, inspect Gitea API responses for media endpoints like GET /api/v1/repos/{owner}/{repo}/media/{filepath} and verify if HTML files are rendered directly in the browser without headers. Check repository commits for HTML files pushed to non-LFS storage.

Impact Analysis

If you access a Gitea repository with this vulnerability, an attacker could run malicious JavaScript in your browser session. This could allow them to steal your session cookies, perform actions on your behalf, or access sensitive data you have permissions to view.

Compliance Impact

This vulnerability could potentially violate GDPR by exposing user data through cross-site scripting (XSS) if malicious JavaScript is executed in a victim's session. It may also breach HIPAA if protected health information is stored in repositories and accessed via the vulnerable endpoint.

Mitigation Strategies

Update Gitea to the latest version that patches this vulnerability. Review repository files for unexpected HTML or JavaScript content. Restrict repository access to trusted users only.

Hi! I’m here to help you understand CVE-2026-96594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70