{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/gofound/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gofound:gofound:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-120444"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GoFound (\u003c= 1.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GoFound"],"content_html":"\u003cp\u003eGoFound through version 1.4.1 contains a path traversal vulnerability in the database parameter. An unauthenticated attacker can exploit this via crafted GET requests to the /api/db/create and /api/db/drop endpoints. By injecting dot-dot-slash (../) sequences into the parameter, the application performs an os.RemoveAll operation on directories outside the intended data directory, leading to arbitrary directory deletion.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to delete arbitrary directories on the server hosting the GoFound application, potentially resulting in system instability, data loss, or denial of service depending on the target path.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade GoFound to a version beyond 1.4.1 once a security update is released by the maintainers.\u003c/li\u003e\n\u003cli\u003eAudit access logs for requests to /api/db/create and /api/db/drop containing path traversal characters.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the GoFound API management endpoints to authorized management IP addresses only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:50:49Z","date_published":"2026-11-02T15:50:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gofound-path-traversal/","summary":"GoFound versions 1.4.1 and earlier are vulnerable to unauthenticated path traversal via the database parameter, allowing attackers to delete arbitrary directories on the host file system.","title":"GoFound: Path traversal arbitrary directory deletion (CVE-2026-120444)","url":"https://feed.craftedsignal.io/briefs/2026-11-gofound-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - GoFound","version":"https://jsonfeed.org/version/1.1"}