CVE-2026-28682

Published March 6th, 2026

View on NVD ↗

CVSS v3

6.4

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.

Forceu/Gokapi

Lightweight selfhosted Firefox Send alternative without public upload. AWS S3 supported.

GitHub

2.75K