CVE-2026-113429

The Gitea platform is vulnerable to a stored Cross-Site Scripting (XSS) flaw in legacy (v1 to v3) Actions artifact uploads. The root cause is the failure to validate the Content-Encoding header, which is stored and served as the artifact's Content-Type. If an attacker uploads an artifact with a v...