| Package | Affected versions | Patched versions |
|---|---|---|
| gitea | < 28.0.0 | 28.0.0 |
Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free