CVE-2024-6886: Inproper Sanitation of field leading to stored XSS

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 33.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-06 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

Affected products

Gitea Open Source Git Server: 1.22.0

References

https://blog.gitea.com/release-of-1.22.1/
https://github.com/go-gitea/gitea/pull/31200

Get alerted when CVE-2024-6886 or the next vulnerability affects your stack