CVE Catalog
CVE-2026-35392
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.68%
49th percentile - higher than 49% of all known CVEs
Summary
In goshs prior to 2.0.0-beta.3, the PUT upload in httpserver/updown.go has no path sanitization, potentially allowing attackers to write files outside the intended directory.
Risk Assessment
An attacker can overwrite critical system files or inject malicious code, leading to remote code execution.
Recommendation
Update to version 2.0.0-beta.3 or later, which includes the fix.
Original NVD description (English source)
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.