Gitea versions from 1.25.0 through 1.25.x allow stored cross‑site scripting via the extensionsRequired field in glTF files displayed by the 3D viewer. A malicious script placed in this field is stored inside the file and runs automatically when the file is viewed in the browser, giving an attacker the ability to execute arbitrary JavaScript for any user who opens the file.

The vulnerability affects deployments of Gitea on releases from 1.25.0 through 1.25.x, i.e., any version prior to 1.26.0. Any system that accepts glTF uploads and renders them via the 3D file viewer may be exposed, as the malicious script is stored within the file and executed upon viewing.

The CVSS score of 8.7 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by uploading a crafted glTF file containing a malicious extensionsRequired payload into a repository; the script would then execute automatically whenever another user accesses the file through the 3D viewer.