EUVD-2026-12080
GHSA-45vh-rpc8-hxpp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | The CVSS 3.1 score of 4.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates a low-to-moderate severity issue that requires low attack complexity and low privileges but lacks confidentiality and integrity impact, affecting only availability through denial of service. The attack vector is network-accessible and requires no user interaction, making it practically exploitable by any authenticated user or public file request participant. However, the actual real-world risk depends on deployment factors: servers with aggressive MaxFileSizeMB global limits and restrictive per-request limits face higher risk, while organizations with generous global limits may find this a lower priority. No active KEV listing or public proof-of-concept has been reported, suggesting limited real-world exploitation thus far. The straightforward attack mechanics (simple HTTP requests to split and upload chunks) indicate this is likely automatable and not technically complex, which could enable rapid exploitation once awareness spreads. This presents a medium-priority issue in organizations where storage exhaustion could cascade into service disruption, but a lower priority in environments with robust storage monitoring and quota enforcement. |
| Exploit ScenarioDerived | An attacker obtains a public file request link configured with a MaxSize limit of 100 MB. The attacker wants to upload a 500 MB file that would exceed the limit. The attacker splits the 500 MB file into five 100 MB chunks, uploads each chunk sequentially through the file request endpoint (each passing individual chunk validation), and then triggers the completion endpoint to assemble the chunks. The upload service combines all five chunks without validating the total size against MaxSize, resulting in a 500 MB file being accepted in the file request despite the 100 MB per-request restriction. This operation consumes 500 MB of storage in violation of administrative policy and, if repeated across multiple file requests, could exhaust server storage and disrupt service availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
A validation bypass in the chunked file upload completion logic for file requests allows attackers to circumvent per-request file size limits by splitting oversized files into smaller chunks that individually pass validation. Attackers with access to a public file request link can sequentially upload chunks to exceed the administrator-configured MaxSize limit, uploading files up to the server's global MaxFileSizeMB threshold. This enables unauthorized storage consumption and potential service disruption through storage exhaustion, though no data exposure or privilege escalation occurs; the vulnerability carries a CVSS score of 4.3 with EPSS and KEV status not currently indicated as critical, suggesting limited real-world exploitation pressure despite straightforward attack mechanics.
RemediationAI
Implement cumulative file size validation in the chunked upload completion handler to verify that the total reassembled file size does not exceed the per-request MaxSize limit, in addition to existing per-chunk validation. Apply the vendor patch or upgrade to the patched version once available from your vendor's security advisory. As an interim mitigation, reduce the global MaxFileSizeMB configuration to match or be slightly above the largest permissible per-request MaxSize to limit the damage radius, implement server-side monitoring and alerting for unusual upload patterns or rapid sequential chunk uploads, and consider restricting file request links to authenticated users only or enabling rate limiting on chunk upload endpoints. Additionally, enforce storage quota enforcement at the filesystem or container level to prevent storage exhaustion from causing complete service denial.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the file request upload completion endpoint, which implements chunked transfer encoding to support large file uploads. The root cause is classified under CWE-20 (Improper Input Validation), specifically the failure to validate the aggregate file size against the per-request MaxSize parameter during chunk reassembly. The upload service validates individual chunks against MaxSize but does not perform cumulative validation when combining chunks into the final file during the completion phase. This is a classic input validation flaw where boundary checks are performed at an intermediate step but bypassed at the final assembly stage. The affected technology involves HTTP chunked transfer encoding combined with a multi-stage upload workflow that separates chunk acceptance from final size validation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
The chunked upload completion path for file requests does not validate the total file size against the per-request MaxSize limit. An attacker with a public file request link can split an oversized file into chunks each under MaxSize and upload them sequentially, bypassing the size restriction entirely. Files up to the server's global MaxFileSizeMB are accepted regardless of the file request's configured limit.
Impact
Any guest with access to a shared file request link can upload files far larger than the administrator-configured size limit, up to the server's global MaxFileSizeMB. This allows unauthorized storage consumption, circumvention of administrative resource policies, and potential service disruption through storage exhaustion. No data exposure or privilege escalation occurs.
Executive ViewAI
CVE-2026-30961 presents moderate security risk, a input validation vulnerability rated CVSS 4.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB