PT-2025-23497 · Gokapi · Gokapi

4Rdr · Published 2025-06-02 · Updated 2026-03-09 · CVE-2025-48494

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.0.0

Description Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. A stored cross-site scripting issue can be exploited by uploading a file with JavaScript code embedded in the filename. The script is then parsed after upload and every time someone opens the upload list. Prior to version 2.0.0, all authenticated users could see and modify all resources, even if end-to-end encrypted, due to the lack of a user permission system.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 to resolve the issue. As a temporary workaround, consider disabling end-to-end encryption until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-87

CWE-79

Related Identifiers

CVE-2025-48494

GHSA-95RC-WC32-GM53

GO-2025-3737

OPENSUSE-SU-2025:15225-1

Affected Products

Gokapi

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48494.json · Exploit
• https://github.com/Forceu/Gokapi/commit/343cc566cfd7f4efcd522c92371561d494aed6b0 · Patch
• https://osv.dev/vulnerability/CVE-2025-48494 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3737 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95rc-wc32-gm53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48494 · Security Note
• https://github.com/Forceu/Gokapi · Note
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53 · Note
• https://github.com/Forceu/Gokapi/releases/tag/v2.0.0 · Note
• https://suse.com/security/cve/CVE-2025-2571 · Note
• https://suse.com/security/cve/CVE-2025-22874 · Note
• https://suse.com/security/cve/CVE-2025-1792 · Note
• https://suse.com/security/cve/CVE-2025-3611 · Note
• https://twitter.com/VulmonFeeds/status/1929509574966411512 · Twitter Post