4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29084

CVE-2026-29084: Gokapi: CSRF in Login Endpoint

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. This issue has been patched in version 2.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29084

CVE-2026-29084:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	< 2.2.3	2.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-hcff-qv74-7hr4, is a Cross-Site Request Forgery (CSRF) in the login endpoint of Gokapi. The root cause was the use of request.Form.Get() in several handlers, including the primary login function showLogin. This function call in Go's net/http package parses form data from both the URL query parameters (GET requests) and the request body (POST requests). This allowed an attacker to craft a malicious URL containing credentials in the query string. When a victim clicks this URL, their browser sends a GET request to the login endpoint, effectively logging them into an account controlled by the attacker.

The fix involved two main changes. First, all instances of r.Form.Get() that handled sensitive data were replaced with r.PostForm.Get(). This ensures that the application only processes data from the body of a POST request, which is the standard and secure way to handle login and other state-changing actions. Second, as a defense-in-depth measure, the session cookie was updated to include the SameSite=Lax attribute via the writeSessionCookie function. This instructs the browser not to send the cookie with cross-site GET requests, providing an additional layer of protection against CSRF attacks.

Vulnerable functions

showLogin

internal/webserver/Webserver.go

The `showLogin` function was vulnerable to Cross-Site Request Forgery (CSRF). It used `r.Form.Get` to retrieve the username and password, which parses values from both the URL query string and the request body. This allowed an attacker to craft a malicious URL with credentials in the query parameters. If a victim clicked this link, their browser would make a GET request, logging them into an account controlled by the attacker. The fix replaces `r.Form.Get` with `r.PostForm.Get`, ensuring that credentials are only read from the POST request body.

changePassword

internal/webserver/Webserver.go

The `changePassword` function was vulnerable to Cross-Site Request Forgery (CSRF) because it used `r.Form.Get` to read the new password. This allowed an attacker to create a malicious link that, when clicked by a logged-in user, would change their password to one known by the attacker. The patch changes this to `r.PostForm.Get`, which only reads from the POST request body, mitigating the CSRF vulnerability.

showDownload

internal/webserver/Webserver.go

The `showDownload` function, when handling password-protected files, was vulnerable to CSRF. It used `r.Form.Get` to retrieve the password from the request, which allowed an attacker to submit the password via a GET request. The fix was to use `r.PostForm.Get` to ensure the password is only submitted through a POST request body.

ParseChunkInfo

internal/storage/chunking/Chunking.go

The `ParseChunkInfo` function, used for handling file uploads, was using `r.Form.Get` to parse chunk information. This is part of a general pattern of insecure form handling that was fixed across the application to prevent CSRF vulnerabilities. The fix ensures that chunk metadata is only read from the POST request body.

ParseFileHeader

internal/webserver/fileupload/FileUpload.go

The `ParseFileHeader` function used `r.Form.Get` to read the `chunkid` and other file parameters. This was part of a broader fix to prevent CSRF by ensuring all form data is read from the POST body using `r.PostForm.Get` instead.

writeSessionCookie

internal/webserver/authentication/sessionmanager/SessionManager.go

This function was modified to add the `SameSite=Lax` attribute to the session cookie. This is a defense-in-depth mitigation for CSRF. While not the source of the vulnerability, this change makes exploiting CSRF vulnerabilities more difficult by preventing the browser from sending the cookie with cross-site requests initiated by links.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.