Executive brief
Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi
Affected products
- Go github.com/forceu/gokapi
Junglewise Threat Intelligence
CVE-2025-48494: GO-2025-3737 - Gokapi vulnerable to stored XSS via uploading file with malicious file name in github.com/forceu/gokapi
CVE-2025-48494 · Severity: medium · CVSS 4 · Published 2025-06-03
Technologies: github.com/forceu/gokapi (Go). Vendors: Go.
Related threats
- GO-2026-4695 - Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload in github.com/forceu/gokapi
- GO-2026-4696 - Gokapi vulnerable to Privilege Escalation in File Replace in github.com/forceu/gokapi
- GO-2026-4698 - Gokapi vulnerable to DoS in E2E Metadata Parser in github.com/forceu/gokapi
- GO-2026-4626 - Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion in github.com/forceu/gokapi
- GO-2026-4613 - Gokapi has Data Leak in Upload Status Stream in github.com/forceu/gokapi