CVE-2026-29084: 
NixOS vulnerability analysis and mitigation

CVE-2026-29084 is a Cross-Site Request Forgery (CSRF) vulnerability in the login endpoint of Gokapi, a self-hosted file sharing server. The flaw exists in all versions prior to 2.2.3, where the login handler accepts credential-bearing form submissions without any CSRF protection tied to the browser session context. It was discovered by aisafe.io, published on March 5, 2026, and patched in version 2.2.3 released the same day. The vulnerability carries a CVSS v3.1 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). The Gokapi login handler parses form values directly from incoming HTTP POST requests and creates a session upon successful credential validation, without verifying that the request originated from a legitimate browser session context (e.g., via a CSRF token or SameSite cookie attribute). An attacker who knows valid credentials can craft a malicious web page that, when visited by a victim, silently submits a login request to the Gokapi instance, associating the victim's browser with a session controlled or known by the attacker. Exploitation requires user interaction (the victim must visit the attacker-controlled page) and the attacker must possess valid credentials for the target Gokapi instance (GitHub Advisory, Gokapi Advisory).

Successful exploitation allows an attacker to force a victim's browser into a session associated with an existing user account for which the attacker knows the credentials — a session fixation-style attack. This can result in user confusion, misattribution of activity to the victim's account, and potential misuse of trusted user actions performed by the victim while unknowingly operating under the attacker's session. The confidentiality and integrity impacts are limited (low), and there is no availability impact, making this a moderate-severity issue (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-29084. The EPSS score is approximately 0.009% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already possess valid Gokapi credentials, which significantly limits the practical attack surface (GitHub Advisory).

1. Credential acquisition: The attacker obtains valid credentials for a target Gokapi instance (e.g., through phishing, credential stuffing, or insider knowledge).
2. Craft malicious page: The attacker creates an HTML page containing a hidden auto-submitting form that POSTs the known credentials to the Gokapi login endpoint (e.g., https://target-gokapi/login) with the appropriate form fields (username and password).
3. Deliver to victim: The attacker tricks the victim into visiting the malicious page (e.g., via a phishing link or embedded iframe on a compromised site).
4. Session fixation: The victim's browser automatically submits the form, causing the Gokapi server to create a session for the attacker-supplied credentials and associate it with the victim's browser cookies.
5. Misuse of victim session: The victim, now logged in under the attacker's chosen account context, may perform actions (file uploads, downloads, sharing) that are attributed to that account, enabling fraud, misattribution, or data exposure (GitHub Advisory).

• Logs: Gokapi access logs showing login POST requests originating from unexpected referrer domains or with no referrer header, particularly if the source IP differs from the authenticated user's typical IP.
• Session Activity: Multiple sessions created for the same account from different IP addresses or user agents in a short time window.
• Network: Unexpected cross-origin POST requests to the Gokapi /login endpoint from external or untrusted origins visible in server-side request logs.

The vendor has released Gokapi version 2.2.3, which patches CVE-2026-29084 along with four other moderate-severity vulnerabilities. All users — especially those running multi-user Gokapi instances — are strongly encouraged to upgrade immediately. No configuration-based workaround is documented; upgrading to v2.2.3 is the only recommended remediation (Gokapi Release, GitHub Advisory).

The vulnerability was discovered and reported by aisafe.io, which published a blog post on the finding. The Gokapi maintainer (Forceu) promptly patched the issue in v2.2.3 and issued a security advisory recommending all users update, particularly those with multiple registered users. Coverage has been limited to automated vulnerability tracking services and the aisafe.io blog; no significant broader media or researcher commentary has been identified (GitHub Advisory, Gokapi Release).