CVE-2026-28737
published 2026-07-03CVE-2026-28737: Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
PriorityP341high8.7CVSS 3.1
AVNACLPRLUIRSCCHIHAN
EPSS
0.34%
26.7th percentile
Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 1.25.0 < 1.26.0 | 1.26.0 |
| gitea | gitea_open_source_git_server | >= 1.25.0 < 1.26.0 | 1.26.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gitea 1.25.x glTF File extensionsRequired cross site scripting (GHSA-9cpj-qc93-vw8v)
vuldb·2026-07-04·CVSS 8.7
CVE-2026-28737 [HIGH] Gitea 1.25.x glTF File extensionsRequired cross site scripting (GHSA-9cpj-qc93-vw8v)
A vulnerability classified as problematic has been found in Gitea 1.25.x. Affected by this vulnerability is an unknown functionality of the component glTF File Handler. The manipulation of the argument extensionsRequired leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2026-28737. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
ghsa·2026-06-17
CVE-2026-28737 [HIGH] CWE-79 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
## Summary
Me again.
Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.
## Affected Versions
- Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration)
- Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer`
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published