Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server

概要

参考情報

• gotify/server security advisory · ADVISORY
• gotify/server#541 · FIX
• research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass · WEB
• vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers · WEB

github.com/gotify/server のその他の脆弱性

• CVE-2026-102603中 5.3Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint…
• GHSA-3244-8mff-w398中Reflected XSS in Gotify's /docs via import of outdated Swagger UI
• CVE-2022-46181中 5.4Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulne…