CVE-2026-30961

Katalog CVE

CVSS 4.3 · Medium EPSS 0,29%

Kerentanan Allocation of Resources Without Limits or Throttling pada forceu gokapi. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4.

Rincian

Terbit di NVD

13 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp advisory vendor
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 product · release notes