CVE-2026-113429 Gitea CVE debrief

Who should care

Administrators and users of Gitea instances, especially those with public repositories, should assess their exposure to this vulnerability and ensure the latest version is deployed to prevent potential script execution with victim's session.

Why it matters

Defenders should prioritize verifying exposure of Gitea instances to untrusted Actions job execution, especially in public repositories, and ensure the latest version is deployed with Content Security Policy properly enforced to prevent potential script execution with victim's session.

• Potential for script execution with victim's session, leading to instance control for administrators.
• Exposure of Gitea instances to untrusted Actions job execution, especially in public repositories.
• Need for verification of Gitea version and Content Security Policy enforcement.
• Prioritization of remediation based on exposure level.

Technical summary

The vulnerability in Gitea's Actions artifact uploads occurs because the request's `Content-Encoding` header was stored unchecked in the column served as the artifact's `Content-Type` on download. A value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. This allows a user who can run an Actions job to upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, potentially leading to script execution with the victim's session.

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to untrusted Actions job execution, especially in public repositories, and ensure the latest version is deployed with Content Security Policy properly enforced.

Recommended defensive actions

• Verify Gitea instance exposure to untrusted Actions job execution, especially in public repositories.
• Ensure the latest version of Gitea (v28.3.0 or later) is deployed.
• Enforce Content Security Policy on Gitea instances.
• Monitor for suspicious Actions job executions and artifact uploads.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Gitea's Actions artifact uploads. Vendor sources indicate the issue is fixed in version 28.3.0. The vulnerability allows for potential script execution with the victim's session, especially in public repositories. Defenders should verify exposure of Gitea instances to untrusted Actions job execution and ensure the latest version is deployed with Content Security Policy properly enforced.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.