CVE-2026-30961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30961", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:34:39.981Z", "datePublished": "2026-03-13T19:09:38.427Z", "dateUpdated": "2026-03-13T19:39:14.146Z"}, "containers": {"cna": {"title": "Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp"}, {"name": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4"}], "affected": [{"vendor": "Forceu", "product": "Gokapi", "versions": [{"version": "< 2.2.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:09:38.427Z"}, "descriptions": [{"lang": "en", "value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4."}], "source": {"advisory": "GHSA-45vh-rpc8-hxpp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:39:04.794330Z", "id": "CVE-2026-30961", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:39:14.146Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30961", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:39:04.794330Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:39:10.071Z"}}], "cna": {"title": "Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload", "source": {"advisory": "GHSA-45vh-rpc8-hxpp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Forceu", "product": "Gokapi", "versions": [{"status": "affected", "version": "< 2.2.4"}]}], "references": [{"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp", "name": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4", "name": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:09:38.427Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30961", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:39:14.146Z", "dateReserved": "2026-03-07T17:34:39.981Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:09:38.427Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Gokapi", "vendor": "Forceu", "versions": [{"status": "affected", "version": "< 2.2.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:forceu:gokapi:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE6F3F4D-D449-43DD-BB3D-86F98581926C", "versionEndExcluding": "2.2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4."}, {"lang": "es", "value": "Gokapi es un servidor de intercambio de archivos autoalojado con soporte para expiraci\u00f3n autom\u00e1tica y cifrado. Antes de la versi\u00f3n 2.2.4, la ruta de finalizaci\u00f3n de carga por fragmentos para solicitudes de archivos no valida el tama\u00f1o total del archivo contra el l\u00edmite MaxSize por solicitud. Un atacante con un enlace p\u00fablico de solicitud de archivo puede dividir un archivo de tama\u00f1o excesivo en fragmentos, cada uno por debajo de MaxSize, y cargarlos secuencialmente, eludiendo por completo la restricci\u00f3n de tama\u00f1o. Se aceptan archivos hasta el MaxFileSizeMB global del servidor, independientemente del l\u00edmite configurado en la solicitud de archivo. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.2.4."}], "id": "CVE-2026-30961", "lastModified": "2026-06-17T10:33:13.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30961", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:39:04.794330Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:35.903", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gokapi", "source": "cna", "vendor": "Forceu"}, "product": "gokapi", "vendor": "forceu"}], "analysis": {"en": {"generated_at": "2026-03-17T17:18:55.394787+00:00", "value": {"mitigation_remediation": ["Upgrade Gokapi to version 2.2.4 or later."], "summary": {"action": "Patch", "impact": "Upload Size Bypass via Chunked Upload"}, "threat_synthesis": {"affected_systems": "Forceu Gokapi self\u2011hosted file sharing server is affected. All deployments running a version earlier than 2.2.4 are vulnerable because the bug is resolved in that release. Users should verify that their instance is not legacy and that a public file\u2011request link exists.", "description_and_impact": "The flaw in Gokapi occurs in the chunked upload completion path for file requests where the total file size is not validated against the per\u2011request MaxSize limit. An attacker who possesses a public file request link can therefore split an oversized file into multiple chunks, each smaller than MaxSize, and upload them sequentially. This evades the intended size restriction, allowing the server to accept files up to the global MaxFileSizeMB limit. The impact is a loss of upload limiting controls and potential resource exhaustion, classified under CWE-770.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low severity, while the EPSS of less than 1% suggests a low likelihood of real\u2011world exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is public, requiring only access to a file request link; no elevated privileges are necessary. Exploitation is straightforward: upload an oversized file in compliant chunks. Patched versions mitigate the issue."}}}}, "created": "2026-03-16T09:24:24.213343+00:00", "updated": "2026-03-23T13:40:17.556777+00:00", "vendors": ["forceu", "forceu$PRODUCT$gokapi"]}