CVE-2026-28682 - Gokapi: Data Leak in Upload Status Stream

CVE ID : CVE-2026-28682 Published : March 6, 2026, 5:16 a.m. | 35 minutes ago Description : Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...