Vulnerabilities

TI-2026-22945 CVE-2026-28737 · GHSA-9cpj-qc93-vw8v

Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

HIGH 71

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00412 Published 2026-07-03 Fixed in 1.26.0 CWE-79

TI-2026-22138 CVE-2026-27780 · GHSA-vhq7-fwwh-7hjf

Gitea pre-receive hook can miss branch-protection checks after scanner errors

MEDIUM 50

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00638 Published 2026-07-03 Fixed in 1.26.0 CWE-863

TI-2026-18124 CVE-2026-22555 · GHSA-fhx7-m96w-mv29

Gitea organization forks can expose organization secrets without create permission

HIGH 70

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00387 Published 2026-07-03 Fixed in 1.26.0 CWE-284

Vulnerabilities

Filters

Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

Gitea pre-receive hook can miss branch-protection checks after scanner errors

Gitea organization forks can expose organization secrets without create permission