Executive brief
goshs is a file server tool used by developers and security professionals to share files. A security flaw in the file upload feature allows an unauthorized user to upload files to locations on the server outside of the intended folder. This could allow an attacker to place malicious files on the system or overwrite existing data, potentially compromising the server's integrity.
Technical details
A path traversal vulnerability exists in the multipart upload handler of goshs versions prior to 2.1.5. The vulnerability is located in `httpserver/updown.go`, where the `part.FileName()` function splits input on the path separator but fails to validate or reject '..' (dot-dot) sequences. An unauthenticated remote attacker can exploit this by providing a crafted filename during a multipart upload, causing the server to create a file outside the designated webroot. This is a residual issue following an incomplete fix for a previous vulnerability. The issue is resolved in version 2.1.5 by properly validating the resolved destination path.
Affected products
- goshs-labs goshs < 2.1.5
Timeline
- 2026-07-27: patched: Fixed in version 2.1.5 via commit f3ef599e409151d1380866e47de8b1afb0bb54fa
- 2026-07-27: advisory: GitHub Security Advisory GHSA-wg2q-39h6-66x9 published
- 2026-07-28: disclosed: CVE-2026-66063 published to NVD