Is CVE-2026-66063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66063 being exploited in the wild.

How severe is CVE-2026-66063?

Medium severity, with a CVSS score of 6.5, published 28 July 2026.

Which products and versions are affected?

github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091.

Is there a fix for CVE-2026-66063?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66063 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66063?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66063: goshs path traversal in multipart upload handler

Q: Is there a fix for CVE-2026-66063?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66063 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-66063?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66063 · Severity: medium · CVSS 6.5 · Published 2026-07-28

goshs is a file server tool used by developers and security professionals to share files. A security flaw in the file upload feature allows an unauthorized user to upload files to locations on the server outside of the intended folder. This could allow an attacker to place malicious files on the system or overwrite existing data, potentially compromising the server's integrity.

Technologies: github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go), goshs.de/goshs/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-66063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66063 being exploited in the wild.
How severe is CVE-2026-66063?: Medium severity, with a CVSS score of 6.5, published 28 July 2026.
Which products and versions are affected?: github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091.
Is there a fix for CVE-2026-66063?: Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66063 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66063?: Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later
```
go get github.com/patrickhener/goshs/v2@v2.1.5-0.20260727065949-f3ef599e4091
```
goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later
```
go get goshs.de/goshs/v2@v2.1.5-0.20260727065949-f3ef599e4091
```

Technical details

A path traversal vulnerability exists in the multipart upload handler of goshs versions prior to 2.1.5. The vulnerability is located in `httpserver/updown.go`, where the `part.FileName()` function splits input on the path separator but fails to validate or reject '..' (dot-dot) sequences. An unauthenticated remote attacker can exploit this by providing a crafted filename during a multipart upload, causing the server to create a file outside the designated webroot. This is a residual issue following an incomplete fix for a previous vulnerability. The issue is resolved in version 2.1.5 by properly validating the resolved destination path.

Affected products

goshs-labs goshs < 2.1.5

Identifiers

CVE-2026-66063
GHSA-wg2q-39h6-66x9
GO-2026-6137

Timeline

2026-07-27: patched: Fixed in version 2.1.5 via commit f3ef599e409151d1380866e47de8b1afb0bb54fa
2026-07-27: advisory: GitHub Security Advisory GHSA-wg2q-39h6-66x9 published
2026-07-28: disclosed: CVE-2026-66063 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.