CVE-2026-66063
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the goshs file server before version 2.1.5, the multipart upload handler in httpserver/updown.go split part.FileName() on / but did not reject .., allowing an unauthenticated attacker to upload a file with a filename containing .. and create a file outside the served tree. This issue is fixed in version 2.1.5.
Risk Assessment
An unauthenticated attacker can write a file to an arbitrary location on the server, potentially leading to remote code execution or modification of critical files.
Recommendation
Update goshs to version 2.1.5 or later.
Other vulnerabilities in goshs
See all- CVE-2026-64863Critical
In goshs file server before version 2.1.4, the WebDAV MOVE method handling did not enforce the --no-delete option, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T.
- CVE-2026-62325Critical
In goshs from version 2.1.3 to 2.1.4, the SFTP password handler only checked that username and password are not empty, so running with -b 'admin:' -sftp and without -fkf left both SFTP authentication handlers unset, allowing unauthenticated file access.
- CVE-2026-40903Critical
goshs is a SimpleHTTPServer written in Go, which prior to version 2.0.0-beta.6 had an ArtiPACKED vulnerability. This vulnerability can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code.
- CVE-2026-35471Critical
In goshs prior to 2.0.0-beta.3, the tdeleteFile() function lacks a return after path traversal check, potentially allowing attackers to access files outside the intended directory.
- CVE-2026-35393Critical
In goshs prior to 2.0.0-beta.3, the POST multipart upload directory is not sanitized, potentially allowing attackers to write files to arbitrary locations.
- CVE-2026-35392Critical
In goshs prior to 2.0.0-beta.3, the PUT upload in httpserver/updown.go has no path sanitization, potentially allowing attackers to write files outside the intended directory.
- CVE-2026-50139Medium
In goshs, a SimpleHTTPServer written in Go, before version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same snapshot and pass the check, exceeding the intended cap. Version 2.1.0 patches the issue.
- CVE-2026-50138High
goshs, a simple HTTP server written in Go, does not enforce mode-restriction flags (--read-only, --upload-only, --no-delete) on the WebDAV port when WebDAV is enabled (-w). An authenticated WebDAV client can perform PUT, DELETE, MKCOL, MOVE, and COPY operations despite the operator's intent. The issue is fixed in version 2.1.0.
- CVE-2026-66064Medium
In the goshs file server before version 2.1.5, the sendFile handler in httpserver/handler.go opened files using a cleaned path but derived the authorization filename from raw req.URL.Path. A trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
- CVE-2026-54719High
In goshs before version 2.1.1, the bulkDownload handler for ZIP downloads did not check ACLs or custom authentication, allowing unauthenticated reads of files protected by .goshs folder ACLs and block lists. This is an incomplete fix for CVE-2026-40189.
Original NVD description (English source)
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.