JavaScript Injection Vulnerability in Gokapi File Sharing Server by Forceu

CVE-2025-48495

What is CVE-2025-48495?

Gokapi, a self-hosted file sharing server, contains a vulnerability that allows authenticated users to rename an API key's friendly name, enabling the injection of malicious JavaScript into the API key overview. This script executes when another user accesses their API tab. Prior to version 2.0.0, Gokapi lacked a user permission system, leaving all authenticated users able to view and alter resources indiscriminately, including those requiring end-to-end encryption, since all users shared the same encryption key. Users operating in isolation without other logged-in users are not impacted. Version 2.0.0 addresses this vulnerability, and a temporary workaround is to refrain from accessing the API page when multiple users are active to prevent potential code injection.

References