The vulnerable API endpoint serves files up to 1 KiB from Git directly to a browser without setting the expected content type or content disposition headers. A user who can push to a repository can commit an HTML file, which the server then renders as a page. When a victim visits the media URL, the malicious JavaScript executes in that victim’s session, giving the attacker the victim’s browser privileges for the Gitea origin. This is a classic stored XSS flaw where arbitrary code can run with the victim’s credentials.

All Gitea releases run on the Gitea:Gitea stack are affected; the fix was delivered in release v28.1.0. Specific vulnerable versions are not enumerated in the CVE, but any deployment before that patch is at risk.

The exploit requires that the attacker have permission to push to a repository and that a victim visits the compromised media URL. The EPSS score is < 1% and the CVSS score is 6.1, while the vulnerability is not listed in CISA KEV. The lack of content headers makes the attack trivial for an attacker who controls repository contents, giving high impact in a collaborative environment. Likely attack vectors involve a supply‑chain or compromised contributor adding malicious HTML to a repo and a user viewing that media resource.