GitHub Advisoryadvisory · Go

GHSA-3c22-5j5m-4jq7 Gokapi has Stored XSS in SVG Hotlinks

HIGH Published 2026-03-05 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-28683
Ecosystem
Go
Packages
github.com/forceu/gokapi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-03-05

Affected packages

• Go github.com/forceu/gokapi: < 2.2.3 → fixed in 2.2.3

Description

Summary If a malicious authenticated user uploads SVG and creates a hotlink for it, they achieve stored XSS. Details The hotlinking functionality fails to properly handle scripts included in the SVGs, allowing authenticated attackers with the ability to upload and hotlink file to execute arbitrary JS. *Issue found by aisafe.io* Impact Authenticated attackers with the ability to upload and hotlink files can execute arbitrary JavaScript.

Related

Alias · CVE (1)

  • CVE-2026-28683 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References