NIXPKGS-2026-0534

GitHub issue published on 7 Mar 2026

Permalink CVE-2026-28683

updated 14 hours ago by @mweinelt Activity log

Created automatic suggestion 1 day, 1 hour ago
@mweinelt accepted 14 hours ago
@mweinelt published on GitHub 14 hours ago

Gokapi: Stored XSS in SVG Hotlinks

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

References

https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7 x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Affected products

Gokapi

==< 2.2.3

Matching in nixpkgs

pkgs.gokapi

Lightweight selfhosted Firefox Send alternative without public upload

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-25.11 2.1.0
- nixos-25.11-small 2.1.0
- nixpkgs-25.11-darwin 2.1.0

Package maintainers

@delliottxyz Darragh Elliott <me+git@delliott.xyz>

Nixpkgs Security Tracker

Details of issue NIXPKGS-2026-0534

References

Affected products

Matching in nixpkgs

pkgs.gokapi

Package maintainers