Cross-Site Scripting Vulnerability in Gokapi File Sharing Server by Forceu

CVE-2025-48494

What is CVE-2025-48494?

Gokapi, a self-hosted file sharing server, has a vulnerability that allows an attacker to exploit stored cross-site scripting. By uploading a file with JavaScript code embedded in the filename, the script is executed whenever the upload list is accessed. Prior to version 2.0.0, Gokapi lacked a user permission system, allowing all authenticated users to view and modify resources, including those protected by end-to-end encryption. This flaw poses a significant threat to data security and privacy. Users with only one authenticated login are not vulnerable, and the issue has been addressed in version 2.0.0. For those unable to upgrade, disabling end-to-end encryption is a potential workaround.

References