Gitea EUVD-2026-93910

Exploitation requires (1) an account with permission to push container images to the Gitea container registry - so the registry feature must be in use and the attacker must hold push rights (the PR:L authentication barrier), and (2) a victim already authenticated to the same Gitea instance who is induced to open the attacker's blob URL directly in a browser (the UI:R interaction requirement). The flaw stems from serving blob downloads with a Content-Type copied from the pushed manifest's declared media type (e.g. text/html) with no Content-Disposition header and no restrictive Content-Security-Policy. Limiting factors: it is not reachable by fully unauthenticated attackers, it requires victim action on a specific URL rather than passive drive-by triggering, and instances that do not expose or use the container registry are unaffected. Fixed in Gitea v28.0.0, which serves blobs as application/octet-stream.

This is a moderate-severity stored cross-site scripting flaw (CWE-79) whose signals are internally consistent and point to a real-but-bounded risk rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes an authenticated attacker (PR:L - any user able to push container images) who needs victim interaction (UI:R - a logged-in victim must open the malicious blob URL), with a scope change (S:C) because script executes on the trusted Gitea origin against a different security authority. All corroborating signals agree it is not widely exploited: EPSS is 0.18% (7th percentile, very low), CISA KEV does not list it (no active exploitation), and SSVC reports Exploitation:none, Automatable:no, Technical Impact:partial. The low Automatable rating fits an XSS requiring a user to be lured into opening a specific URL. No conflicting signals are present - CVSS, EPSS, and SSVC all converge on a low operational priority. The one practical caveat is impact amplification: although rated C:L/I:L, the description explicitly notes the payload can create API tokens as the victim, which could escalate to broader account compromise if a victim is an administrator; this makes the realistic worst case somewhat higher than the 5.4 score alone suggests. Overall this is a legitimate issue to patch on a normal cadence, not a drop-everything event.

An attacker uses any account permitted to push container images and pushes a blob containing HTML/JavaScript with a text/html media type to the Gitea container registry. The attacker then sends another authenticated user a direct link to that blob; when the victim opens it in their browser, the script runs on the Gitea origin and can act as the victim, for example minting an API token for persistent access. No public exploit code was identified at time of analysis, and exploitation requires the victim to open the attacker-supplied URL.