CVE-2026-28737 is a stored cross-site scripting vulnerability in Gitea Open Source Git Server affecting versions from 1.25.0 before 1.26.0. The issue arises from improper neutralization of input in the extensionsRequired field within glTF files processed by the 3D file viewer component. This flaw can enable an attacker with at least limited privileges (PR:L) and user interaction (UI:R) to execute arbitrary scripts, impacting confidentiality and integrity of the application data. The CVSS v3.1 base score is 8.7, indicating a high severity vulnerability with network attack vector, low attack complexity, and no impact on availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when viewing maliciously crafted glTF files. This can lead to compromise of user data confidentiality and integrity within the Gitea instance. There is no direct impact on system availability. The vulnerability requires at least limited privileges and user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid rendering untrusted glTF files with the 3D file viewer or restrict access to trusted users only. Monitor vendor communications for updates on remediation.