Go/code.gitea.io/gitea CVE-2026-28737: high 8.7, EPSS 0.43%

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Action: Upgrade code.gitea.io/gitea to 1.26.0 or later.

go get code.gitea.io/gitea@v1.26.0

Affected

Fixed versions

Sources

• osv: GHSA-9cpj-qc93-vw8v
• https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v
• https://github.com/go-gitea/gitea

CVE-2026-28737 · published 2026-06-17T18:10:19Z · modified 2026-06-25T19:56:26.528825806Z · JSON