Stored XSS in Gitea via glTF File Viewer

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-28737

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	From 1.25.0 (inc) to 1.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea versions from 1.25.0 before 1.26.0. It allows stored cross-site scripting (XSS) attacks through the extensionsRequired field in glTF files that are rendered by the 3D file viewer.

Impact Analysis

The vulnerability can lead to a high-impact security issue where an attacker can execute malicious scripts in the context of the affected application. According to the CVSS score of 8.7, it has high confidentiality and integrity impacts, potentially allowing attackers to steal sensitive information or manipulate data. The attack requires network access, low attack complexity, and some privileges, with user interaction needed.

Hi! I’m here to help you understand CVE-2026-28737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70