CVE-2026-66063

Received Received - Intake

Path Traversal in goshs File Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-66063

Affected Vendors & Products

Vendor	Product	Version / Range
goshs	goshs	to 2.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects goshs, a file server, before version 2.1.5. The issue is in the multipart upload handler which incorrectly processes filenames. It splits the filename on forward slashes but fails to block the use of .. which can allow an attacker to upload a file with a filename containing .. to write outside the intended directory.

Detection Guidance

This vulnerability allows unauthenticated file uploads outside the intended directory. To detect it, check for unexpected files in parent directories (e.g., ..) or files with unusual paths. Inspect server logs for multipart upload requests with filenames containing .. or absolute paths. Verify if the server version is below 2.1.5.

Impact Analysis

An attacker could exploit this to upload files outside the intended directory, potentially overwriting system files or placing malicious content in unauthorized locations. This could lead to data breaches, system compromise, or disruption of services if critical files are overwritten.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure or tampering of sensitive data.

Mitigation Strategies

Upgrade goshs to version 2.1.5 or later to address the vulnerability. Ensure no unauthorized files exist outside the served directory.

Hi! I’m here to help you understand CVE-2026-66063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70