Gokapi Vulnerabilities CVE-2026-30943 and CVE-2026-30955 Disclosed

Feedly

Gokapi Vulnerabilities CVE-2026-30943 and CVE-2026-30955 Disclosed

First seen 14 Mar 2026, 17:55 UTC • •57.8

Article Content

1 / 3

Browse articles

ThreatCluster •March 15, 2026 at 09:10 UTC

•CVE-2026-30943 allows unauthorized file deletions due to insufficient authorization checks.
•CVE-2026-30955 can lead to service disruption through unbounded API requests.
•Both vulnerabilities are patched in Gokapi version 2.2.4.

Two critical vulnerabilities affecting Gokapi, a self-hosted file sharing server, were disclosed on March 13, 2026. CVE-2026-30943 involves an insufficient authorization check in the file replace API, allowing users with limited permissions to delete files belonging to others, with a CVSS score of 4.1. CVE-2026-30955 allows authenticated users to send unbounded request bodies, leading to out-of-memory (OOM) kills and service disruptions, with a CVSS score of 6.5. Both vulnerabilities were fixed in version 2.2.4. The affected versions are prior to 2.2.4. GitHub advisories have been released for both vulnerabilities. The potential impact includes unauthorized file deletions and denial of service for all users. Immediate action is required to update to the latest version to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 209d ago How this analysis works

Timeline

2026-03-13

CVE-2026-30943 and CVE-2026-30955 published

2026-03-14

Articles published detailing the vulnerabilities

2026-03-14

Gokapi version 2.2.4 released to fix vulnerabilities

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Denial of Service
Privilege Escalation
T1068 - Exploitation for Privilege Escalation

Vulnerability (2)

CVE-2026-30943
CVE-2026-30955

Affected Platform (1)

Gokapi

Relationships

CVE-2026-30943 targets Gokapi
CVE-2026-30955 targets Gokapi
Denial of Service targets Gokapi
Privilege Escalation targets Gokapi
T1068 - Exploitation for Privilege Escalation targets Gokapi

Following this threat?

Track CVE-2026-30943 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…