Threats tagged 'ghsa-wpw5-72j3-wj9h'

GoFound versions through 1.4.1 have a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by using ../ sequences in the database parameter. This can be exploited by sending crafted GET requests to /api/db/create and /api/db/drop endpoints, causing the server to remove directories outside the intended data directory.