Homepage

CVE-2026-96594 Affecting gitea-oci-entrypoint package, versions <28.1.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.22% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-GITEAOCIENTRYPOINT-20942228
  • published15 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-96594  (opens in a new tab)

How to fix?

Upgrade Minimos:latest gitea-oci-entrypoint to version 28.1.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitea-oci-entrypoint package and not the gitea-oci-entrypoint package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

The Gitea API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.