What is the CVSS score of CVE-2026-28683?

CVE-2026-28683 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gokapi are affected by CVE-2026-28683?

Gokapi instances are vulnerable to stored cross-site scripting (XSS) attacks when authenticated users upload malicious SVG files and share them via hotlinks.. A patch is available.

How to fix or mitigate CVE-2026-28683?

Within 24 hours: Identify all Gokapi deployments and document current versions; notify stakeholders of exposure risk. Within 7 days: Implement compensating controls (disable SVG uploads or restrict file sharing features); monitor access logs for suspicious SVG uploads. Within 30 days: Establish a vendor contact plan to track patch availability; consider alternative file-sharing solutions if Gokapi cannot be patched within 60 days.

Gokapi CVE-2026-28683

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

GHSA-3c22-5j5m-4jq7

XSS Gokapi Suse

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 05:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

AnalysisAI

Stored XSS in Gokapi through malicious SVG file uploads enables authenticated attackers to execute arbitrary JavaScript in users' browsers via hotlinked files. An attacker with valid credentials can craft SVG payloads that persist in the application and compromise other users accessing the shared links. No patch is currently available for versions prior to 2.2.3.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Gokapi. Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

RemediationAI

Fixed in version 2.2.3.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.