Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | >= 1.25.0, < 1.26.0 | 1.26.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in Gitea's 3D file viewer. The root cause is the improper handling of error messages from the Online3DViewer library. When rendering a crafted .gltf file with an unsupported extension, the viewer generates an error message containing the extension name. Gitea's frontend code then takes this error message and inserts it into the DOM using innerHTML without proper sanitization. An attacker can set a malicious HTML payload as the extension name, which will be executed in the victim's browser when they view the file.
My analysis of the commits between the vulnerable version (1.25.0) and the patched version (1.26.0) revealed that the fix was implemented in commit 1412009d0a58510d0313ed9e8fcc6cba85e21e14. This commit refactors the 3D file viewer to be rendered within a sandboxed <iframe>. Before this change, the 3D viewer was an "inplace" renderer. The error handling for these inplace renderers is located in the renderRawFileToContainer function within web_src/js/features/file-view.ts. This function contains the vulnerable code that uses innerHTML to display error messages. The initRepoFileView function is the entry point that triggers this vulnerable code path. By moving the 3D viewer to an iframe, the vulnerable error handling mechanism is no longer used for .gltf files, thus mitigating the XSS risk.
renderRawFileToContainerweb_src/js/features/file-view.ts
initRepoFileViewweb_src/js/features/file-view.ts