Gophish vulnerabilities
8 vulnerabilities
Known vulnerabilities in Gophish products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Gophish7 vulnerabilities
- Admin Panel1 vulnerabilities
RoutineCVE-2026-107273gophishGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/siteGophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.CVSS5.3MediumEPSS0.20%RoutineCVE-2026-107272gophishGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesGophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.CVSS4.7MediumEPSS0.18%RoutineCVE-2026-107271gophishGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingGophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.CVSS6.9MediumEPSS0.17%PrioritiseCVE-2026-107270gophishGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create EndpointsGophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.CVSS7.1HighEPSS0.20%RoutineCVE-2026-107269gophishGophish through 0.12.1 Username Enumeration via POST /login Timing DiscrepancyGophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.CVSS6.3MediumEPSS0.24%RoutineCVE-2026-82269gophishGophish Account Lockout and Forced Password Change Bypassable via API KeyGophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.CVSS8.6HighEPSS0.55%PrioritiseCVE-2026-39904gophish +1 moreGophish 0.12.1 Denial of Service via Office Document UploadGophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.CVSS7.1HighEPSS0.44%RoutineCVE-2024-2211gophish · admin panel +1 moreCross-Site Scripting vulnerability in Gophish Admin PanelCross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.CVSS6.1MediumEPSS0.29%