Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gokapi: Data Leak in Upload Status Stream
Vulnerability Description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Vulnerability Type
访问控制不恰当
Vulnerability Title
Gokapi 访问控制错误漏洞
Vulnerability Description
Gokapi是Marc Bulling个人开发者的一个轻量级的自托管Firefox发送替代方案。 Gokapi 2.2.3之前版本存在访问控制错误漏洞，该漏洞源于/uploadStatus上的上传状态SSE实现将全局上传状态发布给任何经过身份验证的监听者且包含未限定于请求用户的file_id值，可能导致信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A