---
id: "CVE-2026-120444"
kind: "vulnerability"
aliases: ["CVE-2026-120444"]
title: "GoFound: path traversal lets unauthenticated users delete arbitrary directories"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "gofound", "fixed": [], "affected": "<= 1.4.1", "ecosystem": "go"}]
ecosystems: []
tags: ["go", "gofound", "package", "self-hosted"]
not_affected_if: ["auth-required", "not-network-exposed"]
published_at: "2026-11-02T15:17:26+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:27:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120444", "first_seen_at": "2026-11-02T15:24:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T15:27:23+00:00"}]
---

# GoFound: path traversal lets unauthenticated users delete arbitrary directories

GoFound through 1.4.1 accepts ../ in the database parameter of /api/db/create and /api/db/drop. An unauthenticated GET request, sent directly or through a victim's browser, makes the server run os.RemoveAll on a directory outside its data directory. No fixed release was found; 1.4.1 is the latest on the project's releases page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:gofound affected <= 1.4.1 fixed ?

## How to check

Run gofound --help or check the binary/module version: 1.4.1 and earlier are affected (github.com/sea-team/gofound). Check whether the instance is reachable from untrusted networks; a request such as GET /api/db/drop?database=../x reaches os.RemoveAll outside the data directory. Also check any Go project that imports the gofound module.

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120444
- 2026-11-02T15:27:23+00:00 analyst — VulnCheck advisory (third-party, credit Wu Yulun) says <=1.4.1; GitHub releases page shows 1.4.1 as latest release, no fixed version found; issue #101 not readable. Fix status none, not verified (no vendor statement). VulnCheck CVSS v4 7.2 vs NVD 8.1 listed.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop
- [fix] sea-team/gofound releases (latest v1.4.1) https://github.com/sea-team/gofound/releases
- [mentions] gofound issue 101 (referenced by VulnCheck) https://github.com/sea-team/gofound/issues/101

## From the sources

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_