Legacy Actions artifact uploads stored the request's Content‑Encoding header unchecked, causing the value to be served as the artifact's Content‑Type during download. When the value began with video/ or audio/, the browser’s sandboxing Content‑Security‑Policy was also removed. A user able to run an Actions job can upload content that, when a browser retrieves the artifact’s direct download URL, is rendered as HTML and executes arbitrary JavaScript in the context of the victim’s session. The attacker’s script runs with the victim’s privileges; for an admin account this results in full control of the Gitea instance. The flaw is classified as CWE‑79.

The vulnerability affects Gitea installations that use legacy Actions artifact uploads (versions 1 to 3 of the artifact API) and run any Gitea release prior to 28.3.0. Public repositories that allow Actions jobs provide a direct, anonymous download URL for artifacts, so any public‑facing repository that has Actions enabled is susceptible. All Gitea versions before the 28.3.0 release are impacted; the 28.3.0 release applies a filter that keeps only the gzip marker and selects appropriate serve headers for valid media types.

The flaw is a severe stored XSS; it does not require additional authentication beyond the ability to trigger an Actions job. If an attacker can run a job (for example, through a public workflow or an exposed workflow file), they can upload a malicious artifact that will be rendered when any user opens the download link. The exploit can be performed anonymously against public repositories, so the risk is high for publicly exposed instances. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the severe impact and broad attack surface warrant immediate action.