Live › vulnerability › CVE-2026-120444
GoFound through 1.4.1 accepts ../ in the database parameter of /api/db/create and /api/db/drop. An unauthenticated GET request, sent directly or through a victim's browser, makes the server run os.RemoveAll on a directory outside its data directory. No fixed release was found; 1.4.1 is the latest on the project's releases page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Any GoFound (sea-team/gofound) instance at version 1.4.1 or earlier whose HTTP API is reachable is exposed, because /api/db/create and /api/db/drop need no login and a victim's browser can also send the GET request. It deletes any directory the gofound process can write to. Instances reachable only from trusted networks or behind an authenticating reverse proxy are at much lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gofound | go | <= 1.4.1 | – |
1.4.1 and earlier are affected (github.com/sea-team/gofound)No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-120444")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.