Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-48494

Medium
4.8/10

Summary

Gokapi is a self-hosted file-sharing server with automatic expiration and encryption support. When using end-to-end encryption, a Stored Cross-site Scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the `filename`. After uploading and every time someone opens the upload list, the script is then parsed. There was no user permission system implemented. Therefore, all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users. This issue affects github.com/forceu/gokapi package versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. A possible workaround would be to disable end-to-end encryption.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published