GoFound CVE-2026-120444

Exploitation requires network reachability to the GoFound HTTP API endpoints /api/db/create and /api/db/drop, which per the description accept unauthenticated GET requests; the attacker supplies ../ sequences in the 'database' parameter to escape the data directory and trigger os.RemoveAll on arbitrary directories. The direct attack needs no authentication and no special configuration against instances through version 1.4.1. The main limiting factor is exposure: the API must be reachable by the attacker, or - for the browser-delivered (CSRF-style) variant captured by the assigned UI:P metric - a victim's browser must be able to reach the target instance. No specific non-default feature toggle is named in the sources; the trigger is the traversal payload in the database parameter.

The assigned CVSS 4.0 vector (7.2, High) reports AV:N/AC:L/PR:N, meaning a network-reachable, low-complexity, unauthenticated attack, with impact confined to integrity and availability of the vulnerable system (VI:H/VA:H, VC:N) - consistent with arbitrary directory deletion via os.RemoveAll and no data-confidentiality exposure. There is a notable conflict in the interaction metric: the assigned vector uses UI:P (passive user interaction, reflecting the 'via a victim's browser' CSRF-style path), yet the description explicitly states the GET requests can be sent 'directly,' which implies no user interaction is required for server-exposed instances - verify the intended trigger model with the reporter, as the direct path raises real risk above the 7.2 rating. On decision signals: this is NOT in CISA KEV, there is no confirmed active exploitation, EPSS was not provided in the input, and the only exploit artifact is an unverified PoC reference. The vuln.today priority is 'this_week,' indicating a moderate-high but non-emergency urgency. Netting these out: the flaw is genuinely dangerous where the GoFound HTTP API is network-exposed (unauthenticated, trivial to trigger, destructive), but the absence of KEV/EPSS and the niche footprint of GoFound suggest this is a credible priority for the small population that runs it rather than a widespread emergency. Treat exposed instances as high priority and internet-reachability as the dominant risk driver.

An attacker who can reach a GoFound instance's HTTP API sends a GET request to /api/db/drop (or /api/db/create) with a database parameter containing ../ sequences, causing os.RemoveAll to delete directories outside the intended data directory. Because the endpoints are unauthenticated and accept GET, the same request can also be delivered through a victim's browser (CSRF-style) to reach instances the attacker cannot address directly. A public PoC reference exists; it is not verified as working exploit code.