{"id":"EUVD-2026-41642","enisaUuid":"5e2aac64-a2c5-3e59-a151-a7e6354929ef","description":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","datePublished":"Jul 3, 2026, 8:19:39 PM","dateUpdated":"Jul 7, 2026, 4:58:33 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v\nhttps://github.com/go-gitea/gitea/pull/37233\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","aliases":"CVE-2026-28737\nGHSA-9cpj-qc93-vw8v\n","assigner":"Gitea","epss":0.41,"enisaIdProduct":[{"id":"737041c3-6d4e-3ef5-92f9-b6719375a7c5","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.25.0 \u003c1.26.0"}],"enisaIdVendor":[{"id":"4c3bed13-8120-358a-8fdb-43227973ee60","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"842decfe-51f0-3f85-97dd-0b1e15ff577b","vulnerability":{"id":"GHSA-9cpj-qc93-vw8v","description":"Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer","datePublished":"Jun 17, 2026, 6:10:19 PM","dateUpdated":"Jun 17, 2026, 6:10:19 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v\nhttps://github.com/go-gitea/gitea\n","enisa_id":"EUVD-2026-41642\n","aliases":"CVE-2026-28737\nGHSA-9cpj-qc93-vw8v\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"df8b5ed7-fd19-37d8-a1f5-a2b9f411e5aa","vulnerability":{"id":"CVE-2026-28737","description":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","datePublished":"Jul 3, 2026, 8:19:39 PM","dateUpdated":"Jul 7, 2026, 4:58:33 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v\nhttps://github.com/go-gitea/gitea/pull/37233\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","enisa_id":"EUVD-2026-41642\n","assigner":"Gitea","epss":0.41,"dataProcessed":"Nov 7, 2026, 7:24:07 AM","vulnerabilityProduct":[{"id":"7cb1a44f-0c1e-3531-b946-ce4e0debfa15","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"1.25.0 \u003c1.26.0"}],"vulnerabilityVendor":[{"id":"3ef9b00f-eb7b-3498-9204-76eb79411b6b","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}