CVE-2025-48494 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-48494 Interim 1 4 2026-03-05T00:32:40Z current 2025-07-12T06:35:23Z 2026-03-05T00:32:40Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-48494 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed gnutls-3.8.3-slfo.1.1_5.1 govulncheck-vulndb-0.0.20250612T141001-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 libgnutls30-3.8.3-slfo.1.1_5.1 gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-qcow gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-GCE libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250612T141001-1.1 as a component of openSUSE Tumbleweed Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption. CVE-2025-48494 Image SL-Micro:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate