gohttpserver EUVD-2026-116107

Requires reaching the /upload endpoint of a gohttpserver instance (≤ v1.3.0) that accepts Zip archives and extracts them server-side; the upload feature must be enabled and the service reachable by the attacker. Per CVSS PR:N, an unauthenticated attacker can exploit a default instance that exposes uploads. Limiting factors that reduce real-world exposure: instances with the upload capability disabled, instances placed behind network restrictions or an authentication proxy, and the service account's filesystem write permissions, which bound where traversal-controlled files can land and whether write escalates to code execution.

Signals align toward high priority: the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes remote, low-complexity exploitation with no privileges or user interaction, and the SSVC decision framework reinforces this with Automatable: yes and Technical Impact: total, producing a vuln.today Decision label of act_now. SSVC marks Exploitation as poc, and multiple public references (Snyk Zip Slip research, the Den-Sec VDR-001 advisory, and gohttpserver issue #232) corroborate that a proof-of-concept technique is documented. The main tempering factor is deployment footprint, not severity: gohttpserver is a niche open-source Go file server rather than widely deployed enterprise software, so the population of exposed targets is comparatively small. Two data caveats apply: this is NOT listed in CISA KEV (no confirmed active exploitation), and no EPSS score was provided, so widespread opportunistic exploitation cannot be quantified from the input. Additionally, exploitation depends on the upload capability being enabled and reachable - a deployment condition the raw CVSS 'network/no-privilege' framing does not capture. Net: for any internet-reachable gohttpserver instance with uploads enabled, treat as act_now; the overall fleet-wide risk is bounded by the product's limited prevalence.

An attacker who can reach a gohttpserver instance (≤ v1.3.0) with the upload feature enabled crafts a Zip archive whose entries contain '../' path-traversal sequences and POSTs it to the /upload endpoint; the server extracts the archive without sanitizing member paths, writing attacker-controlled files outside the intended directory. By overwriting sensitive files (e.g., startup scripts, SSH authorized_keys, or binaries writable by the service account), the attacker can escalate arbitrary file write to code execution. A public PoC reference (Den-Sec VDR-001) documents the Zip Slip technique.