PT-2025-23498 · Gokapi · Gokapi

Forceu · Published 2025-06-02 · Updated 2026-03-09 · CVE-2025-48495

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.0.0

Description Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. The issue allows an authenticated user to inject JS into the API key overview by renaming the friendly name of an API key. This injected JS would be executed when another user clicks on the API tab. Prior to version 2.0.0, all authenticated users could see and modify all resources due to the lack of a user permission system, and the encryption key had to be the same for all users.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 to resolve the issue. As a temporary workaround, consider not opening the API page if it is possible that another user might have injected code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-87

CWE-79

Related Identifiers

CVE-2025-48495

GHSA-4XG4-54HM-9J77

GO-2025-3736

OPENSUSE-SU-2025:15225-1

Affected Products

Gokapi

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48495.json · Exploit
• https://github.com/Forceu/Gokapi/commit/65ddbc68fbfdf1c80cadb477f4bcbb7f2c4fdbf8 · Patch
• https://osv.dev/vulnerability/GO-2025-3736 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4xg4-54hm-9j77 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48495 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48495 · Vendor Advisory
• https://github.com/Forceu/Gokapi · Note
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77 · Note
• https://suse.com/security/cve/CVE-2025-2571 · Note
• https://suse.com/security/cve/CVE-2025-22874 · Note
• https://suse.com/security/cve/CVE-2025-1792 · Note
• https://suse.com/security/cve/CVE-2025-3611 · Note
• https://pkg.go.dev/vuln/GO-2025-3736 · Note
• https://suse.com/security/cve/CVE-2025-3230 · Note