Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/forceu/gokapi

10 known vulnerabilities (1 high, 9 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 1 high, 9 medium
Registry
pkg.go.dev

Advisories 10

  • CVE-2026-30961Medium 4.3

    Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload

    Affected: fixed in 2.2.4; all versions.

  • CVE-2026-30955Medium 6.5

    Gokapi vulnerable to DoS in E2E Metadata Parser

    Affected: fixed in 2.2.4; all versions.

  • CVE-2026-30943Medium 4.1

    Gokapi has Privilege Escalation in File Replace

    Affected: fixed in 2.2.4; all versions.

  • CVE-2026-29084Medium 4.6

    Gokapi: CSRF in Login Endpoint

    Affected: fixed in 2.2.3; all versions.

  • CVE-2026-29061Medium 5.4

    Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion

    Affected: all versions; fixed in 2.2.3.

  • CVE-2026-29060Medium 5.0

    Gokapi: Privilege escalation with auth token

    Affected: all versions; fixed in 2.2.3.

  • Gokapi: Stored XSS in SVG Hotlinks

    Affected: fixed in 2.2.3; all versions.

  • CVE-2026-28682Medium 6.4

    Gokapi: Data Leak in Upload Status Stream

    Affected: fixed in 2.2.3; all versions.

  • CVE-2025-48495Medium 4.8

    Gokapi has stored XSS vulnerability in friendly name for API keys

    Affected: all versions; from 1.0.1, through 1.9.6; fixed in 0.0.0-20250530185940-65ddbc68fbfd.

  • CVE-2025-48494Medium 4.8

    Gokapi vulnerable to stored XSS via uploading file with malicious file name

    Affected: from 1.0.1, through 1.9.6; fixed in 0.0.0-20250530191232-343cc566cfd7; all versions.