GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
GoFound versions 1.1.5 through 1.4.1 are affected, and the checked facts list no fixed version.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected GoFound versions 1.1.5 to 1.4.1
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 42/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.
What to do
Check whether your setup matches what the bug needs.
Affected GoFound versions 1.1.5 to 1.4.1Workaround: The checked facts include no workaround or mitigation, so none can be stated from them.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- sea-team GoFound
through 1.4.1
Evidence 5
- Exploit
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120444
What does this mean?
The database parameter in /api/db/drop can register any directory as a database. Deleting that database then removes the directory and all files inside it.Source: vul.yulun.ac.cn
Am I affected, and how do I check?
The advisory lists affected versions as 1.1.5 to 1.4.1, and the product range is recorded as up to and including 1.4.1. To check a installation, compare the GoFound version in use against that range.Source: vul.yulun.ac.cn
What should I do about it?
The checked facts name no fixed version, so no upgrade target can be given from them.Source: vul.yulun.ac.cn
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts include no workaround or mitigation, so none can be stated from them.Source: vul.yulun.ac.cn