CVE-2026-28683 - Vulnerability Analysis

Overview

Gokapi < 2.2.3 contains a stored XSS caused by malicious authenticated user uploading SVG and creating a hotlink, letting attackers execute scripts on other users, exploit requires user authentication.

Severity & Score

Impact

Authenticated attackers can execute scripts in other users' browsers, potentially stealing data or performing actions on their behalf.

Mitigation

Update to version 2.2.3 or later.

References

• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner