CVE-2026-120443

MediumCVSS 6.1

Published: 02/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Malicious HTML is returned unescaped by searcher/engine.go and rendered with v-html in dashboard.vue, executing script in an administrator's browser.

Risk Assessment

Script execution in an administrator's browser can lead to session takeover, data theft, or unauthorized actions in the dashboard.

Recommendation

Update GoFound to a version newer than 1.4.1 and consider disabling v-html rendering for content originating from the index.

Other vulnerabilities in GoFound

CVE-2026-120444High
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

Original NVD description (English source)

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS