What is GHSA-3c22-5j5m-4jq7?

GHSA-3c22-5j5m-4jq7 is a security advisory published by GitHub Security Advisories with High severity. Gokapi has Stored XSS in SVG Hotlinks

Which CVE IDs does GHSA-3c22-5j5m-4jq7 cover?

GHSA-3c22-5j5m-4jq7 covers the following CVE IDs: CVE-2026-28683. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3c22-5j5m-4jq7?

GHSA-3c22-5j5m-4jq7 has a CVSS v3 base score of 8.7, published by GitHub Security Advisories.

Which products are affected by GHSA-3c22-5j5m-4jq7?

GHSA-3c22-5j5m-4jq7 affects 1 product, including: go/github.com/forceu/gokapi:\u003c 2.2.3.

GHSA-3c22-5j5m-4jq7HighCVSS 8.7

Gokapi has Stored XSS in SVG Hotlinks

Vendor

GitHub Security Advisories

Published

March 5, 2026

Last Modified

March 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-28683 →

📋 Description

Summary

If a malicious authenticated user uploads SVG and creates a hotlink for it, they achieve stored XSS.

Details

The hotlinking functionality fails to properly handle scripts included in the SVGs, allowing authenticated attackers with the ability to upload and hotlink file to execute arbitrary JS.

Issue found by aisafe.io

Impact

Authenticated attackers with the ability to upload and hotlink files can execute arbitrary JavaScript.

🎯 Affected products1

go/github.com/forceu/gokapi:< 2.2.3

🔗 References (4)

https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7
https://nvd.nist.gov/vuln/detail/CVE-2026-28683
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3
https://github.com/advisories/GHSA-3c22-5j5m-4jq7