CVE-2026-39904

Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.12.2

Description Authenticated users with the User role can cause a denial of service by uploading a specially crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes these documents as ZIP archives and uses ioutil.ReadAll() on each file entry without enforcing size restrictions on the uncompressed content. This allows a zip bomb—a malicious archive designed to expand to an enormous size when decompressed—to consume several gigabytes of server memory, leading the operating system to terminate the process.

Recommendations Update Gophish to version 0.12.2 or later.