Gitea 3D file viewer allows stored XSS through glTF extensionsRequired

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

Source published

3 Jul 2026 20:19:39 UTC

Source modified

7 Jul 2026 16:58:33 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

Source published

Jul 3, 2026, 8:19:39 PM (timezone not stated)

Source modified

Jul 7, 2026, 4:58:33 PM (timezone not stated)

Observed here

7 Nov 2026 06:34:12 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

Source published

3 Jul 2026 21:16:59 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 07:23:38 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary · 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file. ## Affected Versions - Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration) - Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0 - The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause ## Severity - Stored XSS: the payload persists in the repository and fires on every page view - Executes under the Gitea origin with the victim's session (cookies, CSRF tokens) - Any authenticated user viewing the file is compromised - Enables full account takeover (token creation, settings modification, repository manipulation) - No user interaction beyond viewing the file page is required ## Details ### Root Cause When Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls: ```javascript // In the Online3DViewer bundle (online-3d-viewer.js) // Approximate offset 1142618 in the bundled chunk this.SetError(yp("Unsupported extension: {0}.", unsupportedExtensions.join(", "))); ``` The `SetError` method stores this message, and Gitea's rendering code inserts it into the page using `innerHTML`: ```javascript // Gitea's error display handler element.innerHTML = errorMessage; // unsanitized ``` The extension names from `extensionsRequired` are taken directly from the JSON file with no escaping or sanitization, allowing HTML injection. ### Attack Vector 1. An attacker creates a `.gltf` file with a malicious `extensionsRequired` value: ```json { "asset": {"version": "2.0"}, "buffers": [], "extensionsRequired": ["<img src=x onerror=\"alert(document.cookie)\">"], "scenes": [] } ``` 2. The attacker pushes this file to any Gitea repository they have write access to (including forks of public repositories). 3. When any user navigates to the file's page in the Gitea web UI, the 3D viewer attempts to render it, encounters the "unsupported extension," and inserts the error message (containing the attacker's HTML) into the DOM via `innerHTML`. 4. The injected `<img onerror>` handler executes arbitrary JavaScript under the Gitea origin with the victim's authenticated session. ### Impact From the XSS context, an attacker can: - **Create API access tokens** for the victim by POSTing to `/user/settings/applications` with the page's CSRF token - **Read private repositories** via same-origin API calls - **Modify repository contents** (supply chain attacks) - **Escalate to admin** if the victim is a Gitea administrator - **Exfiltrate data** via `fetch`, `XMLHttpRequest`, or `navigator.sendBeacon` ## Proof of Concept ### Minimal PoC (alert box) Save as `poc.gltf` and push to any Gitea 1.25+ repository: ```json { "asset": {"version": "2.0"}, "buffers": [], "extensionsRequired": ["<img src=x onerror=\"alert('XSS: '+document.domain)\">"], "scenes": [] } ``` Navigate to the file in the Gitea web UI. The alert will fire. ## Suggested Fixes Sanitize or text-encode the error message before DOM insertion. Replace `innerHTML` with `textContent` for error display: ```javascript // Instead of: element.innerHTML = errorMessage; // Use: element.textContent = errorMessage; ``` Alternatively, escape HTML entities in the error message before insertion. ### Additional hardening - Render 3D file previews inside a sandboxed `<iframe>` with `sandbox="allow-scripts"` and a restrictive CSP (`default-src 'none'`), similar to how Gitea already handles SVG attachments - Apply Content-Security-Policy headers to file preview pages that restrict inline script execution

Source published

17 Jun 2026 18:10:19 UTC

Source modified

25 Jun 2026 19:56:26 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Publisher rating · HIGH

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea

Source published

25 Jun 2026 18:43:19 UTC

Source modified

25 Jun 2026 19:45:26 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.