CVE-2026-30961
Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload
Impact
### Summary The chunked upload completion path for file requests does not validate the total file size against the per-request `MaxSize` limit. An attacker with a public file request link can split an oversized file into chunks each under `MaxSize` and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global `MaxFileSizeMB` are accepted regardless of the file request's configured limit. ### Impact Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global `MaxFileSizeMB`. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/forceu/gokapi | <= 2.2.3 | 2.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forceu | Gokapi | before 2.2.4 |