~ / search / GHSA-95rc-wc32-gm53

GHSA-95rc-wc32-gm53

Gokapi vulnerable to stored XSS via uploading file with malicious file name

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-48494

Packages

EcosystemPackageAffectedFixed in
Go github.com/forceu/gokapi >= 1.0.1, <= 1.9.6 no fix listed
Go github.com/forceu/gokapi < 0.0.0-20250530191232-343cc566cfd7 0.0.0-20250530191232-343cc566cfd7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When using end-to-end encryption, a stored XSS vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. With the affected versions <v2.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users with <v2.0. Nethertheless with XSS, other attack vectors like redirection or crypto mining would be possble. ### Patches This CVE has been fixed in v2.0.0 ### Workarounds If you are the only authenticated user using Gokapi, you are not affected. A workaround would be to disable end-to-end encryption.

References

External links from the advisory. They lead to third-party sites.