PT-2026-25358 · Gokapi · Gokapi

Sijisu · Published 2026-03-13 · Updated 2026-03-25 · CVE-2026-30961

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.4

Description Gokapi is a self-hosted file sharing server. The chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks, each under MaxSize, and upload them sequentially, bypassing the size restriction. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion.

Recommendations Update to version 2.2.4 or later.

Exploit

Fix

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-770

CWE-20

Related Identifiers

CVE-2026-30961

GHSA-45VH-RPC8-HXPP

GO-2026-4695

SUSE-SU-2026:1042-1

Affected Products

Gokapi

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30961.json · Exploit
• https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30961 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4695 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30961 · Security Note
• https://osv.dev/vulnerability/GHSA-45vh-rpc8-hxpp · Vendor Advisory
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.4 · Note
• https://github.com/Forceu/Gokapi · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261042-1 · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-31866 · Note
• https://suse.com/security/cve/CVE-2026-29196 · Note
• https://suse.com/security/cve/CVE-2026-28342 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note