{"id":"CVE-2026-120444","kind":"vulnerability","aliases":["CVE-2026-120444"],"related":[],"title":"GoFound: path traversal lets unauthenticated users delete arbitrary directories","description":"GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.","summary":"GoFound through 1.4.1 accepts ../ in the database parameter of /api/db/create and /api/db/drop. An unauthenticated GET request, sent directly or through a victim's browser, makes the server run os.RemoveAll on a directory outside its data directory. No fixed release was found; 1.4.1 is the latest on the project's releases page.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gofound","fixed":[],"affected":"<= 1.4.1","ecosystem":"go"}],"ecosystems":[],"tags":["go","gofound","package","self-hosted"],"not_affected_if":["auth-required","not-network-exposed"],"how_to_check":"Run gofound --help or check the binary/module version: 1.4.1 and earlier are affected (github.com/sea-team/gofound). Check whether the instance is reachable from untrusted networks; a request such as GET /api/db/drop?database=../x reaches os.RemoveAll outside the data directory. Also check any Go project that imports the gofound module.","fix":null,"status":"open","published_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:26:03+00:00","updated_at":"2026-11-02T15:27:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GoFound: path traversal lets unauthenticated users delete arbitrary directories","impact":"high","summary":"GoFound through version 1.4.1 accepts ../ sequences in the database parameter of its /api/db/create and /api/db/drop endpoints. An attacker can send a GET request that makes the server delete any directory it can reach, outside the data directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gofound","self-hosted","go"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker deletes arbitrary server directories without logging in","analyst_note":"Confirm the fixed version and whether a patch exists; check the VulnCheck advisory linked from the NVD entry.","how_to_check":"- Check the GoFound version in use; affected versions are `1.4.1` and earlier.\n- Look for the `/api/db/create` and `/api/db/drop` endpoints on any GoFound instance reachable from the network.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","not-network-exposed"],"who_is_affected":"GoFound instances up to and including 1.4.1 that are reachable over the network are exposed, since the endpoints need no login. Instances not exposed to untrusted networks, or running a later version, are not affected. The sources do not say whether a patched version exists.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4169,"output_tokens":530,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; check the VulnCheck advisory linked from the NVD entry.","search":"'-120444':12A,15A '-2026':11A,14A '/api/db/create':32B,103C '/api/db/drop':34B,105C '1.4.1':25B,64B,76C 'accept':26B 'allow':83C 'arbitrari':8A,88C 'attack':85C,97C 'browser':46B,112C 'contain':77C 'cve':10A,13A 'data':57B,119C 'databas':29B,95C 'delet':7A,87C 'direct':40B,106C 'directori':9A,54B,58B,89C,116C,120C 'fix':60B 'found':63B 'get':37B,100C 'go':17B 'gofound':1A,16A,18B,23B,74C 'host':22B 'latest':67B 'let':4A 'make':47B 'os.removeall':51B,114C 'outsid':55B,117C 'packag':19B 'page':73B 'paramet':30B,96C 'path':2A,79C 'project':70B 'releas':61B,72B 'request':38B,101C 'run':50B 'self':21B 'self-host':20B 'send':99C 'sent':39B 'sequenc':92C 'server':49B 'suppli':91C 'travers':3A,80C 'trigger':113C 'unauthent':5A,36B,84C 'user':6A 'via':108C 'victim':44B,110C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Any GoFound (sea-team/gofound) instance at version 1.4.1 or earlier whose HTTP API is reachable is exposed, because /api/db/create and /api/db/drop need no login and a victim's browser can also send the GET request. It deletes any directory the gofound process can write to. Instances reachable only from trusted networks or behind an authenticating reverse proxy are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gofound"],"ptokens":["gofound"],"labels":["go","gofound","high","package","selfhosted"],"first_public_at":"2026-11-02T15:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120444","severity":null,"published_at":"2026-11-02T15:17:26+00:00","modified_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120444:1382","url":null,"severity":null,"published_at":"2026-11-02T15:27:23+00:00","modified_at":"2026-11-02T15:27:23+00:00","first_seen_at":"2026-11-02T15:27:23+00:00","fetched_at":"2026-11-02T15:27:23+00:00","note":"VulnCheck advisory (third-party, credit Wu Yulun) says <=1.4.1; GitHub releases page shows 1.4.1 as latest release, no fixed version found; issue #101 not readable. Fix status none, not verified (no vendor statement). VulnCheck CVSS v4 7.2 vs NVD 8.1 listed."}],"documents":[{"id":52478,"url":"https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":52612,"url":"https://github.com/sea-team/gofound/releases","title":"sea-team/gofound releases (latest v1.4.1)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52613,"url":"https://github.com/sea-team/gofound/issues/101","title":"gofound issue 101 (referenced by VulnCheck)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}