EUVD-2026-50083
GHSA-964w-f6gj-5236
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector is network, no privileges, no user interaction; impact only low confidentiality.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
AnalysisAI
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Technical ContextAI
The vulnerability lies in the sendFile handler within httpserver/handler.go. The Go standard library's filepath.Clean is correctly applied when opening the file, but the filename used for access-control decisions (block list and ACL-file protection) is taken from the raw req.URL.Path by splitting on '/' and taking the last segment. Because filepath.Clean strips trailing slashes, a request like '/blocked/secret.txt/' opens the real file but produces an empty derived name. The CWE-41 classification (Improper Resolution of Path Equivalence) captures this discrepancy between the path used for authorization and the path used for file access. CPE data shows the affected product is goshs-labs:goshs, with the fix incorporated in version 2.1.5.
RemediationAI
Upgrade to goshs version 2.1.5, which contains the fix. The commit f3ef599e409151d1380866e47de8b1afb0bb54fa modifies sendFile to derive the served filename from the opened file's Stat() call rather than from the raw request path, eliminating the inconsistency. For servers on the v1 branch (1.1.4 and earlier) no patch is available; users should upgrade to the v2 line and then to 2.1.5 as the vendor no longer supports v1. As a workaround, if authentication is available, protect sensitive directories with authentication rather than relying solely on the block list, as authentication is not bypassed by this vulnerability. Another compensating control is to use a reverse proxy that strips trailing slashes before forwarding requests to goshs, though this may alter expected behavior for directory listing.
Improper enforcement of the `--no-delete` flag in goshs WebDAV server allows unauthorized file deletion or overwrite. Th
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory
Critical authorization bypass in goshs (Go-based HTTP server) versions prior to 2.0.0-beta.4 allows unauthenticated atta
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vuln
Path traversal in patrickhener goshs SFTP rename operation enables authenticated attackers to write files outside the co
goshs SimpleHTTPServer versions prior to 2.0.2 allow arbitrary file write via cross-origin PUT requests due to missing C
Same weakness CWE-41 – Improper Resolution of Path Equivalence
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today