GoFound 1.4.1 contains a path traversal flaw that lets an unauthenticated attacker pass directory traversal sequences in the database parameter of the /api/db/create and /api/db/drop endpoints. By exploiting the os.RemoveAll call, the attacker can delete arbitrary directories outside the intended data directory, causing destructive data loss and potential service disruption.

The vulnerability affects the Sea‑Team GoFound product, specifically version 1.4.1. Any installation that exposes the /api/db/create or /api/db/drop API endpoints and runs that version is vulnerable.

The CVSS score of 7.2 reflects high severity for an unauthenticated, remote attack over HTTP. The exploit requires only a crafted GET request to the vulnerable endpoints, making it straightforward for attackers with network access. EPSS is not available, but the simplicity of the attack path indicates a high likelihood of exploitation. The vulnerability has not yet been listed in CISA's KEV catalog.