GoFound - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/gofound/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:50:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGoFound: Path traversal arbitrary directory deletion (CVE-2026-120444)https://feed.craftedsignal.io/briefs/2026-11-gofound-path-traversal/Mon, 02 Nov 2026 15:50:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-gofound-path-traversal/GoFound versions 1.4.1 and earlier are vulnerable to unauthenticated path traversal via the database parameter, allowing attackers to delete arbitrary directories on the host file system.GoFound through version 1.4.1 contains a path traversal vulnerability in the database parameter. An unauthenticated attacker can exploit this via crafted GET requests to the /api/db/create and /api/db/drop endpoints. By injecting dot-dot-slash (../) sequences into the parameter, the application performs an os.RemoveAll operation on directories outside the intended data directory, leading to arbitrary directory deletion.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary directories on the server hosting the GoFound application, potentially resulting in system instability, data loss, or denial of service depending on the target path.

Recommendation

  • Upgrade GoFound to a version beyond 1.4.1 once a security update is released by the maintainers.
  • Audit access logs for requests to /api/db/create and /api/db/drop containing path traversal characters.
  • Restrict network access to the GoFound API management endpoints to authorized management IP addresses only.
]]>highadvisory