CVE-2025-48495 Gokapi has stored XSS vulnerability in friendly name for API keys
Authenticated users can inject JavaScript via API key names, leading to code execution in other users' browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-48495?
CVE-2025-48495 is a medium-severity cross-site scripting vulnerability in Forceu Gokapi, published on 2 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code.
Which versions are affected by CVE-2025-48495?
5 open source packages ship an affected version, including github.com/forceu/gokapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/forceu/gokapi Go | All versions | None |
github.com/forceu/gokapi Go | All versions | 0.0.0-20250530185940-65ddbc68fbfd |
github.com/forceu/gokapi Go | All versions | 0.0.0-20250530185940-65ddbc68fbfd |
github.com/forceu/gokapi Go | From 1.0.1 to 1.9.6 | None |
github.com/forceu/gokapi Go | From 1.0.1 to 1.9.6 | None |
Products include Forceu Gokapi.
How do I fix CVE-2025-48495?
Upgrade github.com/forceu/gokapi to 0.0.0-20250530185940-65ddbc68fbfd or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-48495 being exploited?
There is no known exploitation of CVE-2025-48495 in the wild and no public exploit code.
Other vulnerabilities in Forceu Gokapi
- CVE-2026-28683 Gokapi: Stored XSS in SVG Hotlinks
- CVE-2026-30955 Gokapi vulnerable to DoS in E2E Metadata Parser
- CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
- CVE-2026-29061 Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion
- CVE-2026-29060 Gokapi: Privilege escalation with auth token
Sources
Also known as GHSA-4xg4-54hm-9j77, GO-2025-3736.