CVE-2026-28737 is a stored cross-site scripting vulnerability in Gitea Open Source Git Server affecting versions starting at 1.25.0 up to but not including 1.26.0. The issue arises from improper neutralization of input in the extensionsRequired field of glTF files when rendered by the 3D file viewer. An attacker with limited privileges can inject malicious scripts that execute when other users view the affected content, potentially leading to full compromise of user session confidentiality and integrity.

Successful exploitation allows an attacker with limited privileges to execute arbitrary scripts in the context of other users, leading to complete compromise of confidentiality and integrity of user data within the affected Gitea instance. Availability is not impacted. This can result in theft of credentials, session hijacking, or other malicious actions performed on behalf of the victim user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to uploading or rendering glTF files or disable the 3D file viewer feature if possible to reduce exposure.