CVE-2026-30961

{"id": "CVE-2026-30961", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-03-13T19:54:35.903", "references": [{"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit. This vulnerability is fixed in 2.2.4."}, {"lang": "es", "value": "Gokapi es un servidor de intercambio de archivos autoalojado con soporte para expiraci\u00f3n autom\u00e1tica y cifrado. Antes de la versi\u00f3n 2.2.4, la ruta de finalizaci\u00f3n de carga por fragmentos para solicitudes de archivos no valida el tama\u00f1o total del archivo contra el l\u00edmite MaxSize por solicitud. Un atacante con un enlace p\u00fablico de solicitud de archivo puede dividir un archivo de tama\u00f1o excesivo en fragmentos, cada uno por debajo de MaxSize, y cargarlos secuencialmente, eludiendo por completo la restricci\u00f3n de tama\u00f1o. Se aceptan archivos hasta el MaxFileSizeMB global del servidor, independientemente del l\u00edmite configurado en la solicitud de archivo. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.2.4."}], "lastModified": "2026-03-17T13:46:12.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:forceu:gokapi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE6F3F4D-D449-43DD-BB3D-86F98581926C", "versionEndExcluding": "2.2.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}