Skip to content

Commit eade348

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-45vh-rpc8-hxpp GHSA-4w32-2493-32g7 GHSA-j6jp-78w8-34x6 GHSA-m83q-5wr4-4gfp GHSA-qwc6-vc2v-2ggj GHSA-x8qh-7475-c5mp
1 parent 035412d commit eade348

6 files changed

Lines changed: 404 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-45vh-rpc8-hxpp/GHSA-45vh-rpc8-hxpp.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45vh-rpc8-hxpp",
4+
"modified": "2026-03-13T18:56:51Z",
5+
"published": "2026-03-13T18:56:51Z",
6+
"aliases": [
7+
"CVE-2026-30961"
8+
],
9+
"summary": "Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload",
10+
"details": "### Summary\n\nThe chunked upload completion path for file requests does not validate the total file size against the per-request `MaxSize` limit. An attacker with a public file request link can split an oversized file into chunks each under `MaxSize` and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global `MaxFileSizeMB` are accepted regardless of the file request's configured limit.\n\n### Impact\n\nAny guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global `MaxFileSizeMB`. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/forceu/gokapi"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.2.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/Forceu/Gokapi"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-20"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-03-13T18:56:51Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-4w32-2493-32g7/GHSA-4w32-2493-32g7.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4w32-2493-32g7",
4+
"modified": "2026-03-13T18:57:19Z",
5+
"published": "2026-03-13T18:57:19Z",
6+
"aliases": [
7+
"CVE-2026-31814"
8+
],
9+
"summary": "Yamux vulnerable to remote Panic via malformed WindowUpdate credit",
10+
"details": "### Sumary\nThe Rust implementation of Yamux accepts `WindowUpdate` credit values from the remote peer and applies them to per-stream send-window state. \nA specially crafted `WindowUpdate` can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication.\n#### Attack Scenario \nAn attacker that can establish a Yamux session with a target node can crash the target by sending two validly encoded Yamux frames:\n1. Open a stream (e.g. DATA + SYN) so the stream exists with initial send-window state (`DEFAULT_CREDIT`).\n2. Send a WindowUpdate on that stream with a very large credit value (e.g. 0xFFFF_0000) such that adding credit to the current send-window overflows u32.\n### Impact\nRemote unauthenticated denial of service. \nAn attacker can repeatedly trigger panics by reconnecting and replaying the crafted frame sequence.\n### Patches\nUsers should upgrade to `yamux` `v0.13.9`\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "yamux"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.13.0"
29+
},
30+
{
31+
"fixed": "0.13.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/libp2p/rust-yamux/security/advisories/GHSA-4w32-2493-32g7"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/libp2p/rust-yamux/pull/221"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/libp2p/rust-yamux/commit/b1aae09d60c0bd6a5915a5448f4e8cbc5174db53"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/libp2p/rust-yamux"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/libp2p/rust-yamux/releases/tag/yamux-v0.13.9"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-190"
63+
],
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-03-13T18:57:19Z",
67+
"nvd_published_at": null
68+
}
69+
}

‎advisories/github-reviewed/2026/03/GHSA-j6jp-78w8-34x6/GHSA-j6jp-78w8-34x6.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j6jp-78w8-34x6",
4+
"modified": "2026-03-13T18:56:32Z",
5+
"published": "2026-03-13T18:56:32Z",
6+
"aliases": [
7+
"CVE-2026-30943"
8+
],
9+
"summary": "Gokapi vulnerable to Privilege Escalation in File Replace",
10+
"details": "## Summary\n\nAn insufficient authorization check in the file replace API allows a user with only list visibility permission (`UserPermListOtherUploads`) to delete another user's file by abusing the `deleteNewFile` flag, bypassing the requirement for `UserPermDeleteOtherUploads`.\n\n### Impact\n\nAny authenticated user with `PERM_REPLACE` (replace own files) and `PERM_LIST` (view other users' uploads) can delete any other user's file without needing `PERM_DELETE`.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/forceu/gokapi"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.2.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/Forceu/Gokapi"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-863"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-03-13T18:56:32Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2026/03/GHSA-m83q-5wr4-4gfp/GHSA-m83q-5wr4-4gfp.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m83q-5wr4-4gfp",
4+
"modified": "2026-03-13T18:56:14Z",
5+
"published": "2026-03-13T18:56:14Z",
6+
"aliases": [
7+
"CVE-2026-30915"
8+
],
9+
"summary": "SFTPGo improperly sanitizes placeholders in group home directories/key prefixes",
10+
"details": "### Impact\n\nSFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes.\n\nWhen a group is configured with a dynamic home directory or key prefix using placeholders like `%username%`, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting path may resolve to a parent directory instead of the intended sub-directory.\n\n### Patches\n\nThis issue is fixed in version v2.7.1",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/drakkan/sftpgo/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.3.0"
29+
},
30+
{
31+
"fixed": "2.7.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.7.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/drakkan/sftpgo"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-20"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-03-13T18:56:14Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2026/03/GHSA-qwc6-vc2v-2ggj/GHSA-qwc6-vc2v-2ggj.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qwc6-vc2v-2ggj",
4+
"modified": "2026-03-13T18:56:46Z",
5+
"published": "2026-03-13T18:56:46Z",
6+
"aliases": [
7+
"CVE-2026-30955"
8+
],
9+
"summary": "Gokapi vulnerable to DoS in E2E Metadata Parser",
10+
"details": "### Summary\n\nAn API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.\n\n\n### Impact\n\nAny authenticated user can crash the Gokapi server by sending concurrent large payloads.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/forceu/gokapi"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.2.3"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-qwc6-vc2v-2ggj"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/Forceu/Gokapi"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.2.4"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-400"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-03-13T18:56:46Z",
62+
"nvd_published_at": null
63+
}
64+
}

0 commit comments

Comments
 (0)