CVE-2026-39904: Gophish Zip Bomb Denial of Service via Malicious Email Template

Technical summary

The vulnerability exists in the ApplyTemplate() function within models/attachment.go. Gophish treats Office documents as ZIP archives during template processing. When unpacking these files, the code calls ioutil.ReadAll() on each entry without enforcing size caps on uncompressed content. An attacker can construct a zip bomb—a highly compressed Office document that expands to several gigabytes of data—causing uncontrolled memory consumption. The operating system eventually terminates the process due to resource exhaustion. This is classified as an allocation without size limits (CWE-770).

Business impact

Gophish is commonly deployed in authorized security testing and phishing simulations. A denial of service via malicious template upload would disrupt active campaigns, force service restarts, and potentially compromise test data or campaign continuity. Because the attack requires User role privileges, the threat is limited to insider misuse or compromised low-privilege accounts within organizations running Gophish. However, the impact on availability is severe—the process terminates without graceful degradation.

Affected systems

Gophish through version 0.12.1 is affected. The vulnerability requires network access and authentication with at least User role permissions. Organizations running Gophish for security testing, red team operations, or authorized phishing simulations should verify their deployed version against the vendor advisory to determine exact patched versions and upgrade guidance.

Exploitability

Exploitation requires authentication (User role minimum) and network access, which limits exposure to trusted users or accounts compromised within the organization. No special authentication bypass is needed; any authenticated user with permission to upload templates can trigger this. The crafted Office document requires no user interaction on the server—the vulnerability triggers automatically during the upload and template processing phase. The barrier to exploitation is low for anyone with valid credentials.

Remediation

Update Gophish to a patched version that enforces size limits on uncompressed content during ZIP decompression in the ApplyTemplate() function. Consult the official Gophish release notes and security advisories for the specific version that addresses CWE-770. As an interim mitigation, restrict User role permissions for template uploads to trusted staff only and monitor template upload activity for anomalies.

Patch guidance

Verify the latest Gophish release on the official repository or vendor advisories for the patched version that resolves this allocation-without-limits issue. Apply patches promptly in test and staging environments before production deployment. Confirm that the patch includes explicit size validation for uncompressed ZIP entries during Office document processing. After patching, restart affected Gophish instances and test template upload functionality to ensure normal operation.

Detection guidance

Monitor Gophish process memory usage and CPU load during template uploads, particularly for spikes that indicate zip bomb decompression. Log and alert on failed or abnormally large template upload attempts. Use endpoint detection and response (EDR) tools to identify processes with abnormal memory growth patterns. Review authentication logs for User role accounts performing template uploads, especially from unexpected sources or at unusual times. Implement file size limits at the application or web server layer to reject oversized uploads before they reach Gophish.

Why prioritize this

Although the CVSS score is 6.5 (Medium), this vulnerability warrants prompt attention because it directly impacts service availability in a tool designed for critical security testing. For organizations that depend on Gophish for red team campaigns or phishing simulations, an unplanned outage could delay security assessments. Mitigation is straightforward (patching and access controls), making this a high-value fix relative to effort. The requirement for authentication reduces urgent risk, but the ease of exploitation once authenticated justifies near-term remediation.

Risk score, explained

CVSS 6.5 reflects a network-accessible, low-complexity attack (AC:L) requiring low privileges (PR:L, authenticated User role) with no user interaction (UI:N) that impacts availability only (A:H). The attack does not compromise confidentiality or integrity, and the scope is unchanged (S:U). The score is raised from low/medium due to the direct availability impact and minimal friction once authenticated; it remains below high severity because exploitation is restricted to authenticated users and requires deliberate malicious action.

Frequently asked questions