Executive brief
Gitea, a popular self-hosted Git service, contains a security vulnerability in its 3D file viewer. An attacker can upload a specially crafted 3D model file (glTF) that, when viewed by another user, executes malicious code in their browser. This could lead to the theft of sensitive session information or unauthorized actions being performed on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Gitea's 3D file viewer due to improper neutralization of the 'extensionsRequired' field within glTF files. An attacker with repository write access can upload a malicious glTF file; when a victim views this file, the embedded script executes within the context of the victim's browser session. The vulnerability is tracked as CVE-2026-28737 and was addressed in version 1.26.0 by introducing a new frontend iframe renderer framework that sandboxes 3D model rendering. The exploit requires network access, low privileges (to upload the file), and user interaction (viewing the file).
Affected products
- Gitea Gitea Open Source Git Server 1.25.0 to 1.26.0
Timeline
- 2026-04-18: patched: Fixed in Gitea version 1.26.0
- 2026-07-03: disclosed: CVE-2026-28737 published