CVE-2026-120444: high-severity vulnerability in sea-team GoFound
GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
sea-team · GoFoundRelated CVEs — sea-team GoFound
In the same product, most dangerous first.
References
https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.gohttps://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.gohttps://github.com/sea-team/gofound/issues/101https://vul.yulun.ac.cn/20261102/gofound/https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop