CVE-2026-66063: Path Traversal Arbitrary File Write and Access Control Bypass in goshs
Vulnerability ID: CVE-2026-66063
CVSS Score: 6.5
Published: 2026-07-28
CVE-2026-66063 is an unauthenticated directory traversal and arbitrary file write vulnerability in goshs before version 2.1.5. Due to improper sanitization of file upload names, an unauthenticated attacker can write files outside the served web root. A related trailing slash bypass in the same version allows unauthorized file retrieval.
TL;DR
An unauthenticated path traversal vulnerability in the goshs multipart upload handler allows arbitrary file writes outside the served directory.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network (AV:N)
- CVSS v3.1: 6.5
- Exploit Status: PoC level
- KEV Status: Not listed
Affected Systems
- goshs server deployments with upload functionality enabled
-
goshs: < 2.1.5 (Fixed in:
2.1.5)
Code Analysis
Commit: f3ef599
Fix path traversal in upload and trailing slash bypass in download handler
@@ -131,10 +131,18 @@ ...
Exploit Details
- GitHub Security Advisory: PoC and technical regression tests detailed in advisory repository
Mitigation Strategies
- Upgrade goshs to version 2.1.5 or newer
- Bind goshs to localhost (127.0.0.1) to limit exposure
- Employ a reverse proxy with strict URI normalization
Remediation Steps:
- Download the latest goshs release (version 2.1.5 or higher)
- Replace existing goshs binaries with the secure version
- Restart the goshs service
References
Read the full report for CVE-2026-66063 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)