CVE-2026-66064

Received Received - Intake

Path Traversal in goshs File Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-66064

Affected Vendors & Products

Vendor	Product	Version / Range
goshs	goshs	to 2.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-41	The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The vulnerability in goshs before version 2.1.5 involves a path traversal issue in the sendFile handler. The handler used a cleaned path for file operations but derived authorization from the raw request URL path. A trailing slash in the URL could bypass ACL and block-list protections.

Detection Guidance

To detect this vulnerability, check the version of goshs running on your system. If it is below 2.1.5, the system is vulnerable. Use commands like 'goshs --version' or inspect the binary metadata to verify the version.

Impact Analysis

An attacker could exploit this to access files they shouldn't by manipulating the URL path with a trailing slash, bypassing access controls. This could lead to unauthorized file access or data leakage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if unauthorized data exposure occurs.

Mitigation Strategies

Upgrade goshs to version 2.1.5 or later to address the path traversal vulnerability in the sendFile handler.

Hi! I’m here to help you understand CVE-2026-66064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70