PT-2026-23603 · Gokapi · Gokapi

Sijisu · Published 2026-03-05 · Updated 2026-03-25 · CVE-2026-28683

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3

Description A malicious authenticated user can achieve stored cross-site scripting (XSS) by uploading SVG files and creating a hotlink for them. The hotlinking functionality does not properly handle scripts included in the SVGs, allowing authenticated attackers with file upload and hotlink capabilities to execute arbitrary JavaScript.

Recommendations Update to version 2.2.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28683

GHSA-3C22-5J5M-4JQ7

GO-2026-4612

SUSE-SU-2026:1042-1

Affected Products

Gokapi

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28683.json · Exploit
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28683 · Security Note
• https://osv.dev/vulnerability/GHSA-3c22-5j5m-4jq7 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28683 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4612 · Vendor Advisory
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 · Note
• https://github.com/Forceu/Gokapi · Note
• https://twitter.com/VulmonFeeds/status/2029963494351573017 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029830948045607406 · Twitter Post
• https://suse.com/security/cve/CVE-2026-31961 · Note
• https://suse.com/security/cve/CVE-2026-29054 · Note
• https://suse.com/security/cve/CVE-2026-30961 · Note
• https://suse.com/security/cve/CVE-2026-27946 · Note