Technical impact
The vulnerability allows an authenticated user with the User role to trigger a denial of service by uploading a specially crafted Office document as an email template attachment. The ApplyTemplate function processes the document as a ZIP archive and calls ReadAll on each file entry without enforcing size limits on the uncompressed content, enabling a zip bomb payload to consume gigabytes of memory and cause the server process to terminate. This results in a loss of availability for all users hosted on the affected Gophish instance.
Affected Systems
The flaw exists in Gophish version 0.12.1 and prior releases of the web phishing platform. Users who possess the User role can initiate the attack by uploading Office documents via the attachment feature in the web interface.
Risk and Exploitability
The CVSS score of 7.1 indicates a moderate severity, and while EPSS data is not available, the lack of a KEV listing suggests that mass exploitation has not yet been observed. The attack requires authentication and the ability to upload attachments, making it a potential insider threat. The impact is a service outage caused by memory exhaustion, which can be easily reproduced with a crafted input, resulting in a moderate to high risk for organizations running the vulnerable version.
Github GHSA