PT-2026-25357 · Gokapi · Gokapi

Forceu + 1 · Published 2026-03-13 · Updated 2026-03-25 · CVE-2026-30955

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.4

Description Gokapi is a self-hosted file sharing server that supports automatic expiration and encryption. An API endpoint is susceptible to accepting request bodies of unlimited size. An authenticated user can exploit this to cause an Out-Of-Memory (OOM) kill, leading to a complete service disruption for all users. The issue impacts the server's stability and availability. The affected API endpoint accepts unbounded request bodies. The request body is the vulnerable parameter.

Recommendations Update to version 2.2.4 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-30955

GHSA-QWC6-VC2V-2GGJ

GO-2026-4698

SUSE-SU-2026:1042-1

Affected Products

Gokapi

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30955.json · Exploit
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-qwc6-vc2v-2ggj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwc6-vc2v-2ggj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30955 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30955 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 · Note
• https://github.com/Forceu/Gokapi · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-29196 · Note
• https://suse.com/security/cve/CVE-2026-28342 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-26196 · Note
• https://suse.com/security/cve/CVE-2026-28407 · Note