Legacy (v1 to v3) Actions artifact uploads stored the request's Content-Encoding header unchecked in the column that is served as the artifact's Content-Type on download, and a value starting with video/ or audio/ also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the gzip marker, and the special serve headers are chosen only for valid media types.