A malicious authenticated user can upload a specially crafted SVG file, create a hotlink for it, and cause arbitrary JavaScript to execute in the web browser of any user who views the hotlink. The stored XSS flaw is a classic example of CWE‑79, allowing attackers to hijack sessions, steal credentials or other sensitive data, and potentially deface the interface. The impact is confined to the victim’s browser session but can undermine trust and allow credential theft for accounts that have access to the system.

The vulnerability exists in all versions of the Gokapi self‑hosted file sharing server prior to version 2.2.3 released by Forceu. Anyone running Gokapi 2.2.2 or earlier and allowing authenticated uploads of SVG files is susceptible.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low current exploitation probability and no documented focus by malicious actors. The attack requires an authenticated account, but once an SVG is maliciously crafted, any user viewing the hotlink will trigger the embedded script. The risk to an organization therefore depends on the number of users who may view hotlinked SVGs and the sensitivity of the data accessed through them.