NIXPKGS-2026-0531

GitHub issue published on 7 Mar 2026

Permalink CVE-2026-28682

updated 15 hours ago by @mweinelt Activity log

Created automatic suggestion 1 day, 2 hours ago
@mweinelt accepted 15 hours ago
@mweinelt published on GitHub 15 hours ago

Gokapi: Data Leak in Upload Status Stream

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

References

https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Affected products

Gokapi

==< 2.2.3

Matching in nixpkgs

pkgs.gokapi

Lightweight selfhosted Firefox Send alternative without public upload

nixos-unstable 2.1.0
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-25.11 2.1.0
- nixos-25.11-small 2.1.0
- nixpkgs-25.11-darwin 2.1.0

Package maintainers

@delliottxyz Darragh Elliott <me+git@delliott.xyz>

Nixpkgs Security Tracker

Details of issue NIXPKGS-2026-0531

References

Affected products

Matching in nixpkgs

pkgs.gokapi

Package maintainers