🚨High - Gophish Denial of Service via Office Attachment Zip Bomb (CVE-2026-39904) Gophish's ApplyTemplate() function in models/attachment.go processes uploaded Office documents as ZIP archives and calls ioutil.ReadAll() on each entry without enforcing any limit on uncompressed size. An authenticated user with the User role can upload a crafted Office document as an email template attachment. A zip bomb payload expands to several gigabytes in memory, exhausting server memory and causing the operating system to terminate the Gophish process - a denial of service requiring only a low-privileged account and no user interaction. 👉Affected: Gophish through 0.12.1.
Post summary
The text announces a high‑severity denial‑of‑service vulnerability in Gophish (CVE‑2026‑39904), detailing How the zip bomb is processed and its impact, but provides no PoC, exploit, patch, or evidence of real‑world use.