CVE-2024-6886

10.0 criticalEPSS 33%

Critical (10.0). EPSS 33% chance of exploitation in the next 30 days. Fixed in code.gitea.io/gitea 1.22.1.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

Severity

CVSS 4.0

10.0 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 33% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-08-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4h4p-553m-46qh	Go	code.gitea.io/gitea	<1.22.1	1.22.1
GO-2024-3056	Go	code.gitea.io/gitea	<1.22.1	1.22.1

References

https://blog.gitea.com/release-of-1.22.1/
https://github.com/go-gitea/gitea/pull/31200

Check your stack JSON