What is CVE-2026-120444 in GoFound?
CVE-2026-120444 is a high-severity path traversal vulnerability affecting GoFound through version 1.4.1 analizamos la vulnerabilidad crítica. Unauthenticated attackers can exploit this flaw by supplying path traversal sequences within the database parameter.
The issue is triggered when GET requests are sent directly or via a victim's browser to specific endpoints such as /api/db/create and /api/db/drop. This behavior improperly executes file system operations across the host environment.
Who is affected by this path traversal flaw?
The vulnerability directly impacts systems running vulnerable versions of GoFound where management APIs are exposed to the network. Attackers do not need prior authentication to trigger the flaw.
Similar to issues found in other software components like vulnerabilidad crítica CVSS 8.4, input sanitization failures lead to severe control over system resources. In this case, the flaw results in unauthorized directory removal capabilities.
How does the directory deletion occur?
The underlying flaw forces the application to execute the os.RemoveAll function on arbitrary directories located outside the designated data directory. This can lead to significant data loss or disruption on the target host.
Security advisories from sources like vulnerabilidad crítica con CVSS 8.4 emphasize the risks of exposing administrative endpoints without proper validation layers, mirroring the structural risks present here.
How can I secure my system against this vulnerability?
Protecting your infrastructure requires immediate operational changes since direct patches may require upstream updates. Consider implementing strict perimeter controls and monitoring access logs.
As observed in other ecosystem incidents, mitigation often requires a combination of network isolation and input validation. Review your deployment topology immediately.
What steps should I take to protect my environment?
Follow these configuration and network hardening steps to reduce exposure risk while official fixes are evaluated:
- Isolate GoFound instances behind a reverse proxy that blocks requests containing dot-dot-slash sequences.
- Restrict network access to /api/db/create and /api/db/drop endpoints exclusively to trusted internal IPs.
- Audit file system permissions to ensure the GoFound process runs with the least possible privileges.
- Monitor application logs for unusual GET requests targeting database creation or drop parameters.