Stored Command Injection Vulnerability in Gitea's Legacy Actions Artifact Upload

CVE-2026-113429

What is CVE-2026-113429?

A vulnerability in Gitea's legacy actions artifact uploads allows an attacker to exploit the unchecked Content-Encoding header in requests. When a user uploads an artifact with a media type beginning with video/ or audio/, it removes essential sandboxing restrictions imposed by the Content-Security-Policy. An anonymous user who can run an Actions job can upload malicious artifacts. When these artifacts are accessed via direct download URLs, they can execute scripts in the context of the victim's session, potentially granting the attacker control over the victim's instance, especially if the victim is an administrator. This compromises the integrity and security of Gitea installations by allowing unauthorized script execution.

References