Gitea CVE-2026-96594

Requires an attacker with push/write access to a repository on the target Gitea instance (≤28.0.0). The malicious file must be HTML, committed directly into Git (NOT Git LFS), and at most 1 KiB - this is the specific raw/media serving path (GetRawFileOrLFS) that omitted content-type and content-disposition headers. Exploitation is limited by mandatory victim interaction (the victim must open the media URL in their authenticated session, per UI:R) and by the need for pre-existing push access; instances that restrict repository write access or disallow untrusted contributors sharply reduce exposure. Fixed in v28.1.0.

This is a stored/DOM XSS (CWE-79) in Gitea's raw media API endpoint, rated CVSS 6.1 (medium). Low-priority exploitation signals dominate: EPSS is 0.17% (6th percentile), the CVE is NOT in CISA KEV, SSVC marks Exploitation as 'none' and Automatable 'no' with only 'partial' Technical Impact, and no public exploit was identified. There is a notable conflict between the official CVSS vector and the described preconditions: the vector asserts PR:N (unauthenticated), but the description explicitly states 'a user who can push to a repository' is required - committing an HTML file inherently needs write/push access, so the official PR:N appears to understate the privilege requirement; verify with vendor. The scope change (S:C) and UI:R are consistent with XSS running on the Gitea origin and requiring a victim to open a crafted media URL. Realistically this is a genuine but lower-tier issue: it needs both attacker push access and victim interaction, confining it to targeted abuse (e.g., multi-user instances with open registration or shared repos) rather than mass automated exploitation.

An attacker with push access to a repository on a shared Gitea instance commits a small (<1 KiB) HTML file stored directly in Git (not LFS), then lures a victim into opening its media URL (GET /api/v1/repos/{owner}/{repo}/media/{filepath}). Because the endpoint served the file without content-type/disposition headers, the victim's browser renders it on the Gitea origin and executes attacker JavaScript in the victim's authenticated session. No public exploit code was identified at time of analysis.