CVE Catalog
CVE-2026-35471
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.68%
49th percentile - higher than 49% of all known CVEs
Summary
In goshs prior to 2.0.0-beta.3, the tdeleteFile() function lacks a return after path traversal check, potentially allowing attackers to access files outside the intended directory.
Risk Assessment
An attacker can read or delete system files, leading to a breach of data confidentiality and availability.
Recommendation
Update to version 2.0.0-beta.3 or later, which includes the fix.
Original NVD description (English source)
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.