This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Gitea fixes 11 vulnerabilities
Gitea version 28.1.0 fixes 11 vulnerabilities. The most severe of them are described below; you can find the rest at [1].
An unauthenticated remote attacker can execute arbitrary JavaScript in the context of the application when a victim opens a given file, due to improper handling of HTML files from a repository that are displayed directly in the browser instead of being downloaded [2].
The vulnerability is present in product:
- Gitea; <28.1.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
More information:
- CVE-2026-96594 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An authenticated remote attacker with repository administrator privileges can, due to a missing check in the API, set up automatic mirroring of a repository to an external server, even though the server administrator has forbidden it [3].
The vulnerability is present in product:
- Gitea; <28.1.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-97208 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
An authenticated remote attacker with repository administrator privileges can write content to the server file system, because Gitea checks the permission of the repository owner instead of the user who sent the request [4].
The vulnerability is present in product:
- Gitea; <28.1.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
More information:
- CVE-2026-86684 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 6. 10. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 9. 10. 2026.