8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28683

CVE-2026-28683: Gokapi: Stored XSS in SVG Hotlinks

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28683

CVE-2026-28683:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	< 2.2.3	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue that occurs when an authenticated user uploads a malicious SVG file and creates a hotlink for it. The root cause is the application's failure to properly validate the Content-Type of uploaded files.

The analysis of the commits between the vulnerable version 2.2.2 and the patched version 2.2.3 reveals the vulnerable code, although the specific fixing commit is not immediately obvious from the commit messages.

The primary vulnerable function is chunking.parseContentType located in internal/storage/chunking/Chunking.go. This function determines the Content-Type for a new file. As seen in the code, it trustfully accepts the filecontenttype parameter from the user's request. An attacker can set this to image/svg+xml for an uploaded SVG file containing malicious JavaScript. This Content-Type is then stored in the database associated with the file.

The second function involved is the one that handles serving the hotlinked files. While the exact function name is not present in the provided diffs, it is the component that reads the stored Content-Type from the database and uses it to set the Content-Type HTTP header in the response. When a user visits the hotlink, the browser receives the Content-Type: image/svg+xml header and proceeds to render the SVG, executing the embedded script.

The function models.getHotlinkUrl in internal/models/FileList.go is also relevant as it is responsible for generating the hotlink URL that a victim would click on to trigger the payload. Changes to this function were present in the commits analyzed.

In summary, the exploit chain is as follows:

An attacker uploads an SVG file with a malicious script.
During the upload, the chunking.parseContentType function reads the attacker-supplied Content-Type of image/svg+xml and stores it.
The attacker creates a hotlink to the file using a URL generated by models.getHotlinkUrl.
A victim accesses the hotlink, causing the server to serve the SVG file with the malicious Content-Type, leading to XSS.

Vulnerable functions

chunking.parseContentType

internal/storage/chunking/Chunking.go

This function is responsible for determining the Content-Type of an uploaded file. It directly uses the user-provided `filecontenttype` parameter from the HTTP request without any validation or sanitization. This allows an authenticated attacker to upload a file (e.g., an SVG containing a script) and set the Content-Type to `image/svg+xml`, thus creating a stored XSS vulnerability that is triggered when the file is served via a hotlink.

models.getHotlinkUrl

internal/models/FileList.go

This function constructs the hotlink URL for a file. While not directly vulnerable, it is a necessary component in the exploit chain, as it generates the link that, when visited, triggers the stored XSS vulnerability by serving the malicious SVG file.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.