CVE-2026-120444
GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.
| CWE | CWE-22 |
| Vendor | sea-team |
| Product | gofound |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for sea-team gofound
Be the first to know when new high vulnerabilities affecting sea-team gofound are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
sea-team / GoFound
0 ≤ 1.4.1
References
github.com: https://github.com/sea-team/gofound/issues/101 vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261102/gofound/ github.com: https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go github.com: https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go vulncheck.com: https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop
Credits
Wu Yulun