Security Advisory
CVE-2026-28737
8.7
HIGH
Vulnerability Description
Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
Published Date
July 3, 2026
Official Source
NIST NVD Advisory