CVE-2026-96594: Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to push an HTML file to a repository. The file must be no larger than 1 KiB and stored directly in Git rather than in LFS.
What user interaction is required?
A victim must open the repository media API URL for the attacker-controlled HTML file. The browser then renders the file on the Gitea origin, allowing its JavaScript to run in the victim's session.
What could an attacker do after successful exploitation?
The attacker-controlled JavaScript can act with the permissions of the victim whose session opened the media URL.