Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-06 | 5 | Disclosure3Patch2 |
| 2026-03-11 | 1 | General1 |
CVE-2026-28683 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG an… https://www.cve.org/CVERecord?id=CVE-2026-28683
Post summary
The CVE-2026-28683 vulnerability in Gokapi permits malicious authenticated users to exploit SVG uploads, and this issue is fixed in version 2.2.3.
CVE-2026-28683 (CVSS:8.7, HIGH) is Analyzed. Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if..https://nvd.nist.gov/vuln/detail/CVE-2026-28683 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post simply references CVE‑2026‑28683 with its CVSS score and affected version, providing no PoC, exploit, or mitigation details, making it a generic mention.
🚨*CVE* CVE-2026-28683 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG an… https://www.cve.org/CVERecord?id=CVE-2026-28683 ----- Traducción: CVE-2026-28683 Gok… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑28683, noting the affected version and context of the vulnerability, without providing PoC or exploit details.
CVE-2026-28683 Stored XSS Vulnerability in Gokapi File Sharing Server Before 2.2.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28683
Post summary
The post announces a stored cross‑site scripting flaw in Gokapi File Sharing Server versions older than 2.2.3, linking to vulnerability details without providing proof of exploitation.
🟠 CVE-2026-28683 - High Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for i... https://www.thehackerwire.com/vulnerability/CVE-2026-28683/ https://t.co/DVDdFkfyba
Post summary
The tweet announces CVE-2026-28683 in Gokapi, noting that a malicious authenticated user can exploit an SVG upload and hotlink issue in versions prior to 2.2.3.
[CVE-2026-28683: HIGH] Secure your files with Gokapi's update! Prior to version 2.2.3, a security vulnerability allowed stored XSS through SVG uploads. Update now to stay protected.#cve,CVE-2026-28683,#cybersecurity https://cvefind.com/CVE-2026-28683
Post summary
The post alerts users that Gokapi version 2.2.3 addresses a stored XSS flaw caused by SVG file uploads and encourages an update to mitigate the risk.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | forceu | gokapi | - | - | - |