CVE-2026-66064: CVE-2026-66064: Incorrect Authorization and ACL Bypass via Trailing Slash in goshs

CVE-2026-66064: Incorrect Authorization and ACL Bypass via Trailing Slash in goshs

Vulnerability ID: CVE-2026-66064
CVSS Score: 5.3
Published: 2026-07-28

CVE-2026-66064 is an access control list (ACL) and blocklist bypass vulnerability in the goshs file server prior to version 2.1.5. Due to an inconsistency between uncleaned raw URI path evaluation and normalized file access, remote unauthenticated attackers can retrieve protected files, including the configuration file containing password hashes, by appending a trailing slash to the requested path.

TL;DR

A trailing slash on request paths allows remote attackers to bypass goshs ACLs and blocklists, exposing sensitive configuration files and password hashes.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-41
• Attack Vector: Network
• CVSS v3.1 Score: 5.3
• Exploit Status: PoC / Regression Tests Available
• Impact: Partial Confidentiality Loss
• KEV Status: Not Listed

Affected Systems

• goshs file server prior to version 2.1.5
• goshs: < 2.1.5 (Fixed in: 2.1.5)

Code Analysis

Commit: f3ef599

Fix security bypass in sendFile by deriving target filename from file.Stat() rather than the raw request URL.

Mitigation Strategies

• Upgrade the goshs binary to version 2.1.5 or later to apply the official patch.
• Deploy WAF rules or reverse proxy policies to filter and reject HTTP request paths ending in .goshs/ or other restricted targets with a trailing slash.
• Restrict the binding interface of goshs to localhost (127.0.0.1) unless external access is strictly required.

Remediation Steps:

1. Identify all running instances of goshs in the environment and determine their current version.
2. Build or download goshs version 2.1.5 using 'go install github.com/goshs-labs/goshs@v2.1.5'.
3. Replace the old goshs binary with the updated version and restart the file server.
4. Rotate any bcrypt hashes stored in .goshs configuration files that were exposed to potential exploit attempts.

References

• GHSA-964w-f6gj-5236: Security Bypass / Incorrect Authorization in goshs
• Pull Request #222: Fix security bypass in sendFile
• Fix Commit f3ef599
• CVE Record for CVE-2026-66064

---

Read the full report for CVE-2026-66064 on our website for more details including interactive diagrams and full exploit analysis.

Comments

[Rahul S]

The trailing slash is the trigger, but the root is that the ACL and the file read are looking at two different strings — one decides on the raw URL, the other acts on the resolved path. Deriving the name from file.Stat() is the right fix precisely because it collapses those into a single object you authorize AFTER resolution; anything that authorizes the request string still has the gap. And the trailing slash is just the cheapest instance — %2e, a doubled slash, case-fold on a case-insensitive FS, or a symlink hop all reopen the same door as long as the check runs before canonicalization. Rule of thumb: resolve to the actual object first, then authorize that one, so there's never a moment where the name you checked and the bytes you serve disagree.