CVE-2026-113429 in Gitea
Summary
by MITRE • 11/01/2026
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/01/2026
This vulnerability represents a critical security flaw in legacy versions one through three of Gitea Actions artifact handling mechanisms, specifically involving how HTTP response headers were processed during file storage and retrieval. The core technical failure lies in the unchecked ingestion of the Content-Encoding header from the upload request, which was erroneously stored and subsequently served as the Content-Type header when the artifact was downloaded by a client. This misconfiguration created a direct path for content type confusion attacks, allowing an attacker to dictate how the target browser interprets the file contents rather than relying on actual file extensions or server-side validation of media types.
The severity of this flaw is amplified by its interaction with Gitea's Content-Security-Policy implementation. When the served Content-Type header began with video/ or audio/, the system automatically stripped out sandboxing headers, including the strict Content-Security-Policy directives that are normally applied to protect users from executing malicious scripts within their session context. This removal of security controls effectively disabled browser-side mitigations against cross-site scripting and other code injection attacks for any artifact served under these specific media type prefixes.
The operational impact is severe because it allows for stored cross-site scripting when combined with social engineering or link sharing tactics. A user possessing the ability to run an Actions job within a public repository can upload an artifact crafted to exploit this header confusion. By uploading a file that appears as HTML but triggers the video/ or audio/ Content-Type path, the attacker ensures that no CSP is applied upon download. If a victim opens the direct artifact download URL in their browser while authenticated with administrative privileges, the malicious script executes within the context of the Gitea origin using the administrator's session cookies and permissions. This results in complete remote code execution on behalf of the admin, granting full control over the instance without requiring any further authentication steps beyond opening a link that is reachable anonymously due to the public nature of the repository.
Mitigation strategies focus primarily on upgrading to patched versions where legacy upload behavior has been corrected. In updated implementations, only valid media types are used to determine serve headers, and the Content-Encoding header is no longer blindly trusted or mapped to Content-Type storage. Specifically, legacy uploads now store only the gzip marker for compression detection rather than arbitrary string values that could be manipulated into malicious content type declarations. Administrators of affected systems should immediately upgrade their Gitea instances to a version where this logic has been hardened. Additionally, until an upgrade is performed, it is advisable to restrict artifact download access or implement reverse proxy rules that enforce strict Content-Type validation and ensure CSP headers are always present regardless of the file extension or initial upload metadata.