Which versions of Gophish are affected by CVE-2026-39904?

Gophish versions through 0.12.1 are vulnerable to denial-of-service attacks where authenticated basic users can crash the campaign server by uploading malicious attachments, disrupting ongoing…

Is there a public PoC exploit available for CVE-2026-39904?

Yes, a public proof-of-concept exploit is available for CVE-2026-39904. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-39904?

Within 24 hours: Identify all Gophish instances running v0.12.1 or earlier; restrict file upload capabilities to administrative users only and audit recent upload activity. Within 7 days: Implement strict file upload size limits (<5 MB), disable Office document uploads (DOCX, DOCM, XLSM, PPTM), and configure memory usage alerting. Within 30 days: Contact Gophish project for patch timeline; migrate to alternative tools or await patched releases.

Gophish CVE-2026-39904

Q: What is the CVSS score of CVE-2026-39904?

CVE-2026-39904 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38351 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-22 VulnCheck

GHSA-42jc-v69j-g38f

Denial Of Service Microsoft Gophish

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable web upload (AV:N), trivial crafted file (AC:L), requires authenticated User role (PR:L), no interaction, availability-only impact via OOM (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 21:21 vuln.today

CVE Published

Jun 22, 2026 - 20:11 cve.org

HIGH 7.1

DescriptionCVE.org

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

Articles & Coverage 1

ashikmd7.medium.com CVE-2026-39904: Server Crash via Malicious DOCX File Upload (Denial of Service) Jun 29, 2026

AnalysisAI

Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phishing-campaign server by uploading a zip-bomb Office document as an email template attachment. Publicly available exploit code exists, demonstrating that any account with the User role can trigger an OOM kill of the Gophish process and disrupt ongoing campaigns. No CISA KEV listing is present, but the trivial complexity and available POC make opportunistic abuse realistic against multi-tenant or shared Gophish deployments.

Technical ContextAI

Gophish is an open-source phishing simulation framework written in Go, commonly used by red teams and security awareness programs to deliver templated emails with attachments. The flaw lives in ApplyTemplate() within models/attachment.go, where Office documents (DOCX, XLSX, PPTX) are unpacked as ZIP archives and each contained file is read into memory via ioutil.ReadAll() with no cap on the uncompressed size. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) zip-bomb pattern: a tiny crafted archive can decompress to multiple gigabytes, exceeding host memory and causing the Linux OOM killer to terminate the gophish process.

RemediationAI

No vendor-released patch identified at time of analysis; upstream fix version is not confirmed in the supplied data, so monitor the gophish/gophish GitHub repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload) for an updated release beyond 0.12.1. Compensating controls include restricting Gophish account creation to fully trusted operators and removing the User role from any shared or self-service tenants (trade-off: eliminates delegated campaign authoring), disabling or blocking Office-document attachments in templates and substituting plain HTML or PDF content (trade-off: reduces phishing-simulation realism), placing the Gophish process behind a memory cgroup or systemd MemoryMax limit so an OOM only kills the container rather than the host (trade-off: campaign downtime still occurs), and front-ending uploads with a reverse proxy or pre-validation step that rejects ZIP entries whose declared uncompressed size exceeds a sane threshold.