4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48494

CVE-2025-48494: Gokapi vulnerable to stored XSS via uploading file with malicious file name

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48494

CVE-2025-48494:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	>= 1.0.1, <= 1.9.6
github.com/forceu/gokapi	go	< 0.0.0-20250530191232-343cc566cfd7	0.0.0-20250530191232-343cc566cfd7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-48494) is a stored Cross-Site Scripting (XSS) issue in Gokapi, triggered by uploading a file with a malicious filename containing JavaScript. When the list of uploads is displayed or an individual file's details are shown (e.g., in an edit modal), the embedded script from the filename is parsed and executed by the browser.

The analysis of the patch commit 343cc566cfd7f4efcd522c92371561d494aed6b0 reveals several JavaScript functions that were modified to prevent this XSS. The core of the vulnerability lies in these functions taking user-supplied data (the filename, or data derived from it like a file ID) and inserting it into the DOM using unsafe methods like element.innerHTML = ... or potentially unsafe third-party library methods like datatable.cell().data() if they render HTML content.

Key vulnerable functions identified are:

addRow (in admin_ui_upload.js): This function is central to displaying the list of uploaded files. It was vulnerable because it constructed parts of the table row HTML using string concatenation and innerHTML (e.g., for cellUrl using item.Id which could be derived from the filename, and for cellButtons which constructed an onclick handler passing the raw filename to showEditModal). The patch refactored this to use safer DOM creation methods and introduced sanitizeId() for item.Id.
showEditModal (in admin_ui_upload.js): This function, called when editing a file, directly used innerHTML to display the filename in a modal, making it a clear XSS vector. The patch changed this to use innerText.
decryptFileEntry (in end2end_admin.js): For end-to-end encrypted files, this function updates the filename in the UI. It previously used datatable.cell().data(filename), which could render HTML if the filename was malicious. The patch changed this to use the safer textContent property.
displayError (in end2end_admin.js): This function used to display error messages. If an error could be triggered that incorporated the malicious filename, this would also be an XSS vector. The patch changed this to safer DOM manipulation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48494: Gokapi vulnerable to stored XSS via uploading file with malicious file name

CVE-2025-48494:

4.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

4.8

4.8

CVE-2025-48494: Gokapi vulnerable to stored XSS via uploading file with malicious file name

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

4.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48494: Gokapi vulnerable to stored XSS via uploading file with malicious file name

CVE-2025-48494:

4.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

4.8

4.8

CVE-2025-48494: Gokapi vulnerable to stored XSS via uploading file with malicious file name

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI