Gokapi vulnerable to stored XSS via uploading file with malicious file name
Date: 2025-06
Affected: go/github.com/forceu/gokapi, go/github.com/forceu/gokapi
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-48494
CWE: CWE-79
CWE-87

### Impact When using end-to-end encryption, a stored XSS vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. With the affected versions <v2.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users with <v2.0. Nethertheless with XSS, other attack vectors like redirection or crypto mining would be possble. ### Patches This CVE has been fixed in v2.0.0 ### Workarounds If you are the only authenticated user using Gokapi, you are not affected. A workaround would be to disable end-to-end encryption.


Mitigations:

Architectural layers (MAESTRO):