Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Apply the new Gitea vulnerabilities patch to resolve 18 Gitea vulnerabilities, including XSS flaw CVE-2026-113429 and token leak bug CVE-2026-112887. #Gitea #DevOps #Git #Cybersecurity #CVE2026113429 #AppSec #Vulnerability #InfoSec https://meterpreter.org/gitea-vulnerabilities-patch-28-3-0/