VulnSocial

CVE-2026-120444

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-02: 111-02
Referenced assets1 URL
By indicator
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli

    🔴 GoFound'da (Go programlama diliyle geliştirilmiş, açık kaynaklı bir full-text search motoru) kimlik doğrulamasız dizin silme açığı! CVE-2026-120444 | HIGH (CVSS 8.1) GoFound ≤ 1.4.1 sürümlerinde Path Traversal açığı, uzaktaki saldırganların ../ ifadeleri üzerinden uygulamanın veri dizini dışındaki dizinleri silmesine yol açabiliyor. ● Authentication gerekmiyor. ● /api/db/drop ve /api/db/create endpoint'leri etkileniyor. ● os.RemoveAll üzerinden veri kaybı ve hizmet kesintisi riski mevcut. Etkilenen sürümler: 0–1.4.1 Yama durumu henüz doğrulanmış değil. İnternete açık GoFound kurulumlarında erişimi kısıtlayın. Advisory: https://github.com/advisories/GHSA-wpw5-72j3-wj9h

    00011244
    3.1K followersView on X

Explore more

Back to dashboard