PT-2026-23606 · Gokapi · Gokapi

Sijisu · Publicado 2026-03-05 · Atualizado 2026-03-25 · CVE-2026-29084

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3

Description Gokapi, a self-hosted file sharing server, had a flaw in its login process. Before version 2.2.3, the login flow lacked CSRF protection, meaning credential-bearing requests weren’t properly linked to the user’s browser session. The system directly processed form values and established a session upon successful credential verification. This could allow an attacker to hijack a user's session if the attacker knows the credentials, potentially leading to user confusion and misuse of account access.

Recommendations Update to version 2.2.3 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-29084

GHSA-HCFF-QV74-7HR4

GO-2026-4624

SUSE-SU-2026:1042-1

Produtos afetados

Gokapi

Referências · 137

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29084.json · Exploit
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 · Nota
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4 · Aviso do Fabricante
• https://github.com/Forceu/Gokapi · Nota
• https://suse.com/security/cve/CVE-2026-23999 · Nota
• https://suse.com/security/cve/CVE-2026-27575 · Nota
• https://suse.com/security/cve/CVE-2026-31807 · Nota
• https://suse.com/security/cve/CVE-2026-27945 · Nota
• https://suse.com/security/cve/CVE-2026-27899 · Nota
• https://suse.com/security/cve/CVE-2026-27138 · Nota
• https://suse.com/security/cve/CVE-2026-28789 · Nota
• https://suse.com/security/cve/CVE-2026-29771 · Nota
• https://suse.com/security/cve/CVE-2026-0528 · Nota
• https://suse.com/security/cve/CVE-2026-29054 · Nota
• https://suse.com/security/cve/CVE-2026-26998 · Nota