Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload

TRUNG BÌNH 4.3CVE-2026-30961 · GHSA-45vh-rpc8-hxpp · GO-2026-4695 · Công bố 13/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-30961 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng github.com/forceu/gokapi, gokapi (forceu).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.26%, cao hơn 18.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.2.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/forceu/gokapi Go	`< 2.2.4mọi phiên bản`	`2.2.4`
gokapi forceu	`< 2.2.4`	`2.2.4`

Mô tả

Summary

The chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit.

Impact

Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global MaxFileSizeMB. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.

Mô tả của NVD

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4.