Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server

Description

References

• gotify/server security advisory · ADVISORY
• gotify/server#541 · FIX
• research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass · WEB
• vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers · WEB

More vulnerabilities in github.com/gotify/server

• CVE-2026-102603MEDIUM 5.3Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint…
• GHSA-3244-8mff-w398MEDIUMReflected XSS in Gotify's /docs via import of outdated Swagger UI
• CVE-2022-46181MEDIUM 5.4Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulne…