CVE-2026-120444

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

Enables unauthenticated deletion of arbitrary directories on the server, potentially leading to data loss and service unavailability. May be exploited to destroy critical system resources.

Update GoFound to a version newer than 1.4.1 if available, or enforce validation of the database parameter blocking ../ sequences. Restrict access to /api/db/create and /api/db/drop endpoints and require authentication.