The vulnerability arises when Gitea’s container registry serves blob downloads using a Content‑Type directly from the image manifest, without a Content‑Disposition header or a restrictive Content‑Security‑Policy. A user who is able to push container images can store a blob that contains HTML and JavaScript and label it with a text/html media type. When an authenticated victim opens that blob URL in a browser, the injected script executes in the victim’s browser context on the Gitea origin, enabling the attacker to perform actions as the victim, such as generating API tokens. The primary consequence is the loss of confidentiality and integrity of user credentials and authorization tokens.

All Gitea installations that are running any version prior to 28.0.0 are vulnerable, as the patch was released with the 28.0.0 update. The issue is specific to instances that host a container registry and allow users to push images.

The exploit requires an attacker to have the ability to push images to the target Gitea instance. Once this permission is granted, the attacker can compose a malicious image manifest and blob, and the compromise is immediate when a victim visits the blob URL. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score is 5.4. Given the straightforward attack flow and the high impact of token theft, the risk level warrants urgent remediation. The attack vector is therefore likely an internal or compromised account with image‑push privileges.