EUVD-2026-94404
GHSA-5724-58m3-c7r6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with low complexity, but requires an authenticated low-privileged account (PR:L); SSRF yields only information disclosure, so C:L and I:N/A:N with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.
AnalysisAI
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the server to fetch arbitrary internal URLs through the POST /api/import/site endpoint, because the default dialer deny list does not block loopback or RFC1918 private destinations. Attackers can read the responses of reachable internal services and enumerate internal hosts and ports from differential error messages, but the impact is confined to information disclosure with no write, code-execution, or availability effect, and authentication is mandatory (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated Gophish account with at least low-privilege API access (PR:L); the attacker then abuses the POST /api/import/site import-site feature, whose default dialer deny list does not block loopback or RFC1918/private-host destinations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue, not a top-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data: the supplied references point to the vulnerable source (dialer.go deny list and controllers/api/import.go at commit b1648f0) rather than to a fix commit or tagged release, so the status is 'no vendor-released patch identified at time of analysis' and defenders should monitor https://github.com/gophish/gophish releases for a version published after 0.12.1 and the VulnCheck advisory for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8),
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerab
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phis
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.1
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrato
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated m
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated med
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today