EUVD-2026-50082
GHSA-wg2q-39h6-66x9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network attack, no auth needed, low complexity; limited write impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
AnalysisAI
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory by uploading a file with the name '..'. Affects versions up to 2.1.4; fixed in 2.1.5. The older v1 branch (<=1.1.4) remains vulnerable with no patch. No active exploitation has been reported.
Technical ContextAI
The multipart upload handler in updown.go splits the Part.FileName() on '/' to remove directory components but does not reject '..', so filepath.Join with '..' creates a file in the parent directory outside the webroot. The root cause is a path traversal (CWE-22). The CPE cpe:2.3:a:goshs-labs:goshs:*:*:*:*:*:*:*:* indicates all versions of goshs are potentially affected, but the advisory specifically identifies v2 up to 2.1.4 and v1 up to 1.1.4 as vulnerable.
RemediationAI
Upgrade goshs v2 to version 2.1.5 or later, which includes the fix from commit f3ef599e409151d1380866e47de8b1afb0bb54fa. For goshs v1 (<=1.1.4), no patch is available; migrate to v2 if possible. If migration is not feasible, disable the upload endpoint (e.g., remove or restrict access to the /upload route) or enforce network-level access controls to limit upload functionality to trusted users only. Note that disabling uploads may break intended use cases.
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. Th
Critical authorization bypass in goshs (Go-based HTTP server) versions prior to 2.0.0-beta.4 allows unauthenticated atta
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vuln
Path traversal in patrickhener goshs SFTP rename operation enables authenticated attackers to write files outside the co
goshs SimpleHTTPServer versions prior to 2.0.2 allow arbitrary file write via cross-origin PUT requests due to missing C
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today