Cross-site scripting in Gitea - CVE-2026-103667
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript on the Gitea origin and take over victim accounts, potentially gaining control of the entire instance if a site administrator is compromised.
The vulnerability exists due to improper validation of layer and config mediaType values in the Gitea container registry when processing image manifests and serving stored blobs with an attacker-controlled Content-Type. A remote user can publish a blob containing HTML and JavaScript with mediaType set to text/html and lure a victim into opening its URL and authenticating when prompted to execute the script on the Gitea origin, bypass same-origin request protections, and create a persistent, all-scope API token through /user/settings/applications.