Reflected XSS in Gotify's /docs via import of outdated Swagger UI
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Impact Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX. An attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. ### Patches The vulnerability has been fixed in version 2.2.3. ### References https://github.com/gotify/server/pull/541
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/gotify/server (Go) | before 2.2.3 | 2.2.3 | Patch available | GHSA-3244-8mff-w398 |
- github.com/gotify/server (Go) Vendor— Affected before 2.2.3 Fixed in 2.2.3 Patch available GHSA-3244-8mff-w398
Remediation
- Fix · GHSA-3244-8mff-w398 github.com/gotify/server (Go) Fixed in 2.2.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-3244-8mff-w398
References
Other 5
- https://github.com/gotify/server/security/advisories/GHSA-3244-8mff-w398
- https://github.com/gotify/server/pull/541
- https://github.com/gotify/server
- https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass
- https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences