CVE-2026-28683: Forceu Gokapi XSS Vulnerability

CVE-2026-28683 Overview

CVE-2026-28683 is a stored Cross-Site Scripting (XSS) vulnerability in Gokapi, a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a malicious authenticated user can upload an SVG file containing malicious JavaScript and create a hotlink for it, resulting in stored XSS attacks against other users who access the hotlinked content.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the context of victim browsers, potentially stealing session cookies, performing actions on behalf of users, or delivering further attacks through the trusted Gokapi application.

Affected Products

• Forceu Gokapi versions prior to 2.2.3

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-28683 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28683

Vulnerability Analysis

This stored XSS vulnerability arises from insufficient sanitization of SVG file content when uploaded to the Gokapi file sharing server. SVG files, being XML-based, can contain embedded JavaScript code within elements such as <script> tags or event handlers like onload, onclick, and similar attributes.

When an authenticated user uploads a specially crafted SVG file and generates a hotlink for sharing, the server serves the SVG file directly to visitors without properly sanitizing or neutralizing the embedded malicious scripts. This allows the attacker's JavaScript to execute in the browser context of any user who views the hotlinked SVG, making it a persistent (stored) XSS attack.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack requires network access and low privileges (an authenticated account), but successful exploitation can impact both confidentiality and integrity of the victim's session across the changed security scope.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize SVG file content before serving it to users via hotlinks. SVG files are inherently capable of containing executable JavaScript, and the Gokapi application prior to version 2.2.3 did not implement adequate content filtering or Content-Security-Policy headers to prevent script execution when serving user-uploaded SVG files.

Attack Vector

The attack requires network access and targets authenticated functionality. An attacker must first authenticate to the Gokapi server, then upload a malicious SVG file containing embedded JavaScript payloads. After creating a hotlink for the uploaded file, the attacker shares this link with potential victims. When victims access the hotlink, their browsers render the SVG and execute the embedded malicious scripts.

The SVG file would typically contain JavaScript within <script> elements or inline event handlers. When served directly by the Gokapi server without sanitization, the browser interprets and executes this code in the context of the application's origin, granting the attacker access to session data, cookies, and the ability to perform actions as the victim.

Detection Methods for CVE-2026-28683

Indicators of Compromise

• Unusual SVG file uploads containing <script> tags or JavaScript event handlers
• Hotlink creation activity for SVG files from recently registered or suspicious accounts
• Client-side reports of unexpected JavaScript execution or browser security warnings when accessing shared files
• Web application firewall logs showing blocked XSS patterns in uploaded file content

Detection Strategies

• Implement file content inspection rules to detect JavaScript patterns within uploaded SVG files
• Monitor web server access logs for requests to SVG hotlinks, particularly from IP addresses different than the uploader
• Deploy browser-based XSS detection mechanisms such as Content-Security-Policy violation reporting
• Review uploaded file metadata and content for known XSS payload signatures

Monitoring Recommendations

• Enable detailed logging for file upload and hotlink generation events in Gokapi
• Configure web application firewall rules to inspect uploaded file content for malicious scripts
• Implement real-time alerting for SVG uploads containing script-related elements
• Monitor user session activity for anomalies that could indicate session hijacking following XSS exploitation

How to Mitigate CVE-2026-28683

Immediate Actions Required

• Upgrade Gokapi to version 2.2.3 or later immediately to address this vulnerability
• Audit existing uploaded SVG files for potentially malicious content
• Temporarily disable SVG file uploads or hotlink functionality if immediate patching is not possible
• Review access logs for evidence of exploitation attempts

Patch Information

The vulnerability has been patched in Gokapi version 2.2.3. Organizations running affected versions should upgrade immediately. Detailed patch information is available in the GitHub Release v2.2.3. Additional security information can be found in the GitHub Security Advisory GHSA-3c22-5j5m-4jq7.

Workarounds

• Configure web server rules to serve SVG files with Content-Disposition: attachment headers to force download instead of inline rendering
• Implement Content-Security-Policy headers that restrict script execution on pages serving user-uploaded content
• Block or restrict SVG file uploads at the application or web server level until the patch can be applied
• Use a reverse proxy to strip potentially dangerous elements from SVG files before serving them to users

# Example nginx configuration to force SVG downloads instead of inline rendering
location ~ \.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
}