Legacy (v1 to v3) Actions artifact uploads stored the request's "Content-Encoding" header unchecked in the column that is served as the artifact's "Content-Type" on download, and a value starting with "video/" or "audio/" also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the "gzip" marker, and the special serve headers are chosen only for valid media types.