CVE-2026-39904 Details

A denial-of-service vulnerability has been identified in Gophish versions through 0.12.1. This issue allows authenticated users with the User role to exhaust server memory by uploading a specially crafted Office document as an email template attachment. The vulnerability arises in the ApplyTemplate() function within models/attachment.go, where Office documents are processed as ZIP archives. The function reads each file entry's uncompressed content into memory using ioutil.ReadAll() without any size restrictions. This oversight enables a zip bomb payload to decompress into several gigabytes of data, leading to excessive memory consumption and causing the application to be terminated by the operating system.

Gophish should implement size restrictions on uncompressed data read from user-uploaded ZIP archives. Before processing any ZIP file entries, the application must validate both compressed and uncompressed sizes, rejecting files that exceed a specified limit. Additionally, replace the direct use of ioutil.ReadAll() with an io.LimitedReader to enforce strict size limits, such as 50MB per entry. Safeguards against zip bombs should also be introduced by monitoring the cumulative extracted size and limiting the total number of files processed from an archive.