CVE-2026-28683HIGH 8.7EPSS p8.6%

CVE-2026-28683CVE-2026-28683

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

Scoring

CVSS 3.18.7 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS0.19% probability of exploitation · percentile 8.6% · 2026-06-19T12:03:05Z
Published2026-03-06
Last modified2026-03-09

Underlying weaknesses· 1

CWE-79

References

  1. https://github.com/Forceu/Gokapi/releases/tag/v2.2.3
  2. https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')cwe-790%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-25242
CVE
CVE-2026-33172
CVE
CVE-2025-63307
CVE
CVE-2026-34932
CVE
CVE-2025-60880
CVE
CVE-2026-40883
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.