{"id":"CVE-2026-120444","published":"2026-11-02T15:17:26.917","lastModified":"2026-11-02T19:35:33.347","description":"GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go","tags":[]},{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go","tags":[]},{"url":"https://github.com/sea-team/gofound/issues/101","tags":[]},{"url":"https://vul.yulun.ac.cn/20261102/gofound/","tags":[]},{"url":"https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop","tags":[]}],"exploitRefs":[{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go","tags":[]},{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go","tags":[]},{"url":"https://github.com/sea-team/gofound/issues/101","tags":[]}],"hasPoc":true,"ai":null}