CVE-2024-6886
NoneCVSS
—
EPSS
33.0%
Published
Aug 6, 2024
CISA due date
—
The record
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | code.gitea.io/gitea | 0 | 1.22.1 |
| Chainguard | gitness | 0 | 0 |
| Wolfi | gitness | 0 | 0 |
Related vulnerabilities
- GO-2026-4363 Gitea does not properly validate repository ownership when deleting Git LFS locks in… Also affects code.gitea.io/gitea
- GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to… Also affects code.gitea.io/gitea
- GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access… Also affects code.gitea.io/gitea
- GO-2026-4367 Gitea has improper access control for uploaded attachments in code.gitea.io/gitea Also affects code.gitea.io/gitea
- GO-2026-4368 Gitea improperly exposes issue titles and repository names through previously started… Also affects code.gitea.io/gitea
- GO-2026-4370 Gitea does not properly validate project ownership in organization project operations in… Also affects code.gitea.io/gitea
- GO-2026-4366 Gitea does not properly verify authorization when canceling scheduled auto-merges via the… Also affects code.gitea.io/gitea
- GO-2026-4369 Gitea does not properly validate ownership when toggling OpenID URI visibility in… Also affects code.gitea.io/gitea