GoFound: Path traversal arbitrary directory deletion (CVE-2026-120444)

GoFound through version 1.4.1 contains a path traversal vulnerability in the database parameter. An unauthenticated attacker can exploit this via crafted GET requests to the /api/db/create and /api/db/drop endpoints. By injecting dot-dot-slash (../) sequences into the parameter, the application performs an os.RemoveAll operation on directories outside the intended data directory, leading to arbitrary directory deletion.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary directories on the server hosting the GoFound application, potentially resulting in system instability, data loss, or denial of service depending on the target path.

Recommendation

• Upgrade GoFound to a version beyond 1.4.1 once a security update is released by the maintainers.
• Audit access logs for requests to /api/db/create and /api/db/drop containing path traversal characters.
• Restrict network access to the GoFound API management endpoints to authorized management IP addresses only.