Paper/Archive/CVE-2026-35392

CVE-2026-35392

patrickhener goshs — goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

EPSS 0.7%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.5.525 × 2010.5 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.

Affected

ProductAffectedFixed inSource

goshs< 2.0.0-beta.3–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/patrickhener/goshs/security/advisories/GHSA-g8mv-vp7j-qp64