Go/code.gitea.io/gitea CVE-2026-28737: high 8.7, EPSS 0.41%

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea

Action: Upgrade code.gitea.io/gitea to 1.26.0 or later.

go get code.gitea.io/gitea@v1.26.0

Affected

Fixed versions

Sources

• osv: GO-2026-5286
• nvd: CVE-2026-28737
• https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v

CVE-2026-28737 · published 2026-06-25T18:43:19Z · modified 2026-06-25T19:45:26.304381421Z · JSON