4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48495

CVE-2025-48495: Gokapi has stored XSS vulnerability in friendly name for API keys

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48495

CVE-2025-48495:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	>= 1.0.1, <= 1.9.6
github.com/forceu/gokapi	go	< 0.0.0-20250530185940-65ddbc68fbfd	0.0.0-20250530185940-65ddbc68fbfd

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the 'friendly name' field for API keys. Authenticated users could inject JavaScript by renaming an API key's friendly name. This injected script would then execute in the browser of any user viewing the API key overview page.

The root cause lies in the unsafe use of innerHTML in the JavaScript code responsible for handling and displaying these friendly names.

Injection Point: The addFriendlyNameChange function in internal/webserver/web/static/js/admin_ui_api.js was directly responsible for the injection. When a user edited a friendly name, the new name (newName) was taken from an input field and then written back to the table cell using cell.innerHTML = newName;. This allowed arbitrary HTML and JavaScript to be injected and rendered immediately in the editor's view, and then saved to the server via apiAuthFriendlyName.
Stored XSS Trigger: The addRowApi function in the same file is responsible for generating and displaying the list of API keys in a table. When this table was rendered, if a stored friendly name contained malicious JavaScript, and if addRowApi used innerHTML to display this name, the script would execute in the context of any user viewing the page. The patch extensively refactors addRowApi to use safer methods like innerText and document.createElement for rendering cell content, indicating that this function was also a critical part of the vulnerability display and mitigation.

The patch addresses these issues by replacing innerHTML assignments with innerText where user-controlled or dynamic data is displayed. innerText treats the content as plain text, preventing HTML or script injection. Additionally, dynamic HTML elements (like buttons) are now created using DOM manipulation methods (document.createElement, appendChild, etc.) rather than string concatenation with innerHTML, which is a more secure practice.

Therefore, both addFriendlyNameChange (for input and immediate rendering of the malicious name) and addRowApi (for displaying the stored malicious name to other users) are key functions related to this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.