GoFound path traversal allows arbitrary directory deletion

Anyone can make the GoFound search server delete folders.

Summary

GoFound does not check the database parameter, so an unauthenticated attacker can delete any directory and everything inside it. Versions 1.1.5 through 1.4.1 are affected.

What to do

No fixed version is named in the sources. Check that you run a version newer than 1.4.1 and read the vendor's advisory.

Products and platforms

GoFound

CVE IDs

CVE-2026-120444 (opens in a new tab)

Sources

Write-up: vul.yulun.ac.cn (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC