Is CVE-2026-66064 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66064 being exploited in the wild.

How severe is CVE-2026-66064?

Medium severity, with a CVSS score of 5.3, published 28 July 2026.

Which products and versions are affected?

github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091.

Is there a fix for CVE-2026-66064?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66064 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66064?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66064: goshs-labs goshs ACL bypass via trailing slash in sendFile handler

Q: Is there a fix for CVE-2026-66064?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66064 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-66064?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66064 · Severity: medium · CVSS 5.3 · Published 2026-07-28

goshs, a tool for serving files over HTTP, contains a security flaw that allows unauthorized access to restricted files. By adding a trailing slash to a web request, an attacker can bypass the software's block list and access sensitive configuration files, including those containing administrative password hashes. This could lead to the exposure of private data and internal security credentials.

Technologies: github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go), goshs.de/goshs/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-66064 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66064 being exploited in the wild.
How severe is CVE-2026-66064?: Medium severity, with a CVSS score of 5.3, published 28 July 2026.
Which products and versions are affected?: github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.4, SEMVER:introduced=0,fixed=2.1.5-0.20260727065949-f3ef599e4091.
Is there a fix for CVE-2026-66064?: Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66064 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66064?: Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later
```
go get github.com/patrickhener/goshs/v2@v2.1.5-0.20260727065949-f3ef599e4091
```
goshs.de/goshs/v2 (Go): upgrade to 2.1.5-0.20260727065949-f3ef599e4091 or later
```
go get goshs.de/goshs/v2@v2.1.5-0.20260727065949-f3ef599e4091
```

Technical details

The vulnerability exists in the `sendFile` handler within `httpserver/handler.go`. The function derives the filename for authorization checks from the raw request path (`req.URL.Path`), but opens the file using a cleaned path (`filepath.Clean`). When a trailing slash is appended to the request, the derived filename becomes an empty string, which fails to trigger the 'never-serve' rule for the `.goshs` ACL file and bypasses the `acl.Block` list. An attacker can exploit this to retrieve restricted files, including the ACL file containing bcrypt password hashes. Authentication itself is not bypassed; however, files intended to be blocked by the ACL are exposed. The issue is addressed in version 2.1.5-0.20260727065949-f3ef599e4091.

Affected products

patrickhener goshs <= 1.1.4
patrickhener goshs/v2 <= 2.1.4
goshs.de goshs <= 1.1.4
goshs.de goshs/v2 <= 2.1.4

Identifiers

CVE-2026-66064
GHSA-964w-f6gj-5236
GO-2026-6134

Timeline

2026-07-27: patched: Fix committed to repository
2026-07-28: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.