CVE-2026-39904: Gophish denial of service via Office document upload in ApplyTemplate

Executive brief

Gophish, an open-source phishing simulation platform, is vulnerable to a denial-of-service attack. An authorized user can crash the server by uploading a specially crafted Office document as an email template. This results in the server running out of memory and shutting down, disrupting ongoing security training and phishing simulations.

Technical details

A denial of service (DoS) vulnerability exists in Gophish versions up to and including 0.12.1 due to improper resource management in the ApplyTemplate() function within models/attachment.go. The application processes uploaded Office documents as ZIP archives but fails to enforce size limits on the uncompressed content. By calling ioutil.ReadAll() on entries within a crafted 'zip bomb' document, an authenticated attacker with standard User privileges can trigger unbounded memory allocation. This leads to system memory exhaustion and subsequent process termination by the operating system OOM killer. As of the advisory date, no official patch has been released.

Affected products

• Gophish Gophish <= 0.12.1

Timeline

• 2026-06-22: disclosed
• 2026-06-22: advisory

References

• https://api.github.com/users/ashikmd7
• https://github.com/ashikmd7
• https://api.github.com/users/ashikmd7/gists%7B/gist_id%7D
• https://api.github.com/users/ashikmd7/repos
• https://avatars.githubusercontent.com/u/225560826?v=4
• https://api.github.com/users/ashikmd7/events%7B/privacy%7D