CVE-2026-29084

Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation. This issue has been patched in version 2.2.3.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

References

github.com/...Gokapi/security/advisories/GHSA-hcff-qv74-7hr4

github.com/Forceu/Gokapi/releases/tag/v2.2.3

cve.org (CVE-2026-29084)

nvd.nist.gov (CVE-2026-29084)

Download JSON