A stored cross-site scripting vulnerability in Forceu Gokapi allows authenticated users to execute malicious scripts, posing a significant risk to administrative sessions and data integrity.

This is a stored XSS vulnerability (CWE-79) triggered by the improper neutralization of input during web page generation. An authenticated user can upload a crafted SVG file and generate a hotlink to execute arbitrary JavaScript in the context of other users visiting the link.

The vulnerability carries a CVSS score of 8.7, which reflects a high severity due to the potential for session hijacking, unauthorized actions performed on behalf of legitimate users, and the compromise of sensitive data. Because the application facilitates file sharing, successful exploitation could lead to the widespread distribution of malicious payloads to unsuspecting users, resulting in significant reputational and operational damage.

Immediate Action: Update the Gokapi installation to version 2.2.3 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Audit file upload directories and review access logs for unusual SVG file activity or suspicious hotlink creation patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block malicious SVG uploads.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of XSS in a collaborative file-sharing environment, organizations should prioritize upgrading their Gokapi instances to version 2.2.3 immediately. Failure to patch allows authenticated users to bypass security controls and potentially compromise the integrity of the entire platform.