The flaw in Gokapi occurs in the chunked upload completion path for file requests where the total file size is not validated against the per‑request MaxSize limit. An attacker who possesses a public file request link can therefore split an oversized file into multiple chunks, each smaller than MaxSize, and upload them sequentially. This evades the intended size restriction, allowing the server to accept files up to the global MaxFileSizeMB limit. The impact is a loss of upload limiting controls and potential resource exhaustion, classified under CWE-770.

Forceu Gokapi self‑hosted file sharing server is affected. All deployments running a version earlier than 2.2.4 are vulnerable because the bug is resolved in that release. Users should verify that their instance is not legacy and that a public file‑request link exists.

The CVSS score of 4.3 indicates low severity, while the EPSS of less than 1% suggests a low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is public, requiring only access to a file request link; no elevated privileges are necessary. Exploitation is straightforward: upload an oversized file in compliant chunks. Patched versions mitigate the issue.