CVE-2025-48494 Gokapi vulnerable to stored XSS via uploading file with malicious file name
Attackers can execute arbitrary scripts in victim browsers by uploading files with malicious names when end-to-end encryption is enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-48494?
CVE-2025-48494 is a medium-severity cross-site scripting vulnerability in Forceu Gokapi, published on 2 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption.
Which versions are affected by CVE-2025-48494?
5 open source packages ship an affected version, including github.com/forceu/gokapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/forceu/gokapi Go | All versions | None |
github.com/forceu/gokapi Go | All versions | 0.0.0-20250530191232-343cc566cfd7 |
github.com/forceu/gokapi Go | All versions | 0.0.0-20250530191232-343cc566cfd7 |
github.com/forceu/gokapi Go | From 1.0.1 to 1.9.6 | None |
github.com/forceu/gokapi Go | From 1.0.1 to 1.9.6 | None |
Products include Forceu Gokapi.
How do I fix CVE-2025-48494?
Upgrade github.com/forceu/gokapi to 0.0.0-20250530191232-343cc566cfd7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-48494 being exploited?
There is no known exploitation of CVE-2025-48494 in the wild and no public exploit code.
Other vulnerabilities in Forceu Gokapi
- CVE-2026-28683 Gokapi: Stored XSS in SVG Hotlinks
- CVE-2026-30955 Gokapi vulnerable to DoS in E2E Metadata Parser
- CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
- CVE-2026-29061 Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion
- CVE-2026-29060 Gokapi: Privilege escalation with auth token
Sources
Also known as GHSA-95rc-wc32-gm53, GO-2025-3737.