CVE Catalog
CVE-2026-35393
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.68%
49th percentile - higher than 49% of all known CVEs
Summary
In goshs prior to 2.0.0-beta.3, the POST multipart upload directory is not sanitized, potentially allowing attackers to write files to arbitrary locations.
Risk Assessment
An attacker can overwrite critical system files or inject malicious code, leading to remote code execution.
Recommendation
Update to version 2.0.0-beta.3 or later, which includes the fix.
Original NVD description (English source)
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.