Executive brief
goshs is a simple web server tool used to share files over a network. A security flaw allows an unauthenticated attacker to delete any file or directory on the host system that the server has permission to access. This could lead to total data loss, system instability, or the destruction of critical application files.
Technical details
A path traversal vulnerability exists in the `deleteFile()` function within `httpserver/handler.go`. While the code implements a check for '..' sequences in the URL path, it fails to include a `return` statement after identifying a malicious path. Consequently, the execution flow continues to `os.RemoveAll()`, which processes the unsanitized path. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request with a `?delete` parameter and double-encoded traversal sequences to delete arbitrary files or directories outside the intended webroot. The issue is resolved in version 2.0.0-beta.3.
Affected products
- patrickhener goshs < 2.0.0-beta.3
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Fix released in version 2.0.0-beta.3