Vulnerability · Published Jun 22, 2026 · Assigned by VulnCheck

CVE-2026-39904Gophish 0.12.1 Denial of Service via Office Document Upload

Medium 6.5

In plain English

A medium-severity resource allocation without limits in gophish from gophish. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/gophish/gophish	no fix listed	GHSA-42jc-v69j-g38f
Go	github.com/gophish/gophish	no fix listed	GO-2026-6212

Affected products (as reported)

Vendor	Product	Versions
gophish	gophish	0 – through 0.12.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload third-party-advisory