| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/forceu/gokapi | < 2.2.4all versions | 2.2.4 |
| gokapi | < 2.2.4 | 2.2.4 |
The chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit.
Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global MaxFileSizeMB. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free