CVE-2026-38600 in gohttpserver
Summary
by MITRE • 11/03/2026
A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as a Zip Slip flaw within the upload functionality of codeskyblue gohttpserver versions up to and including 1.3.0 represents a critical file system security failure. This specific class of vulnerability, formally categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, occurs when an application processes archive files without adequately sanitizing the internal paths contained within them. In this context, the server accepts zip archives uploaded by users and extracts their contents into a designated directory on the host system. The core technical flaw lies in the insufficient validation of file names extracted from the zip payload. Specifically, the software fails to detect or reject path traversal sequences such as dot-dot-slash (../) embedded within the filenames inside the archive. When an attacker constructs a malicious zip file containing entries with relative paths that escape the intended target directory, the extraction logic blindly follows these paths and writes files to arbitrary locations on the server's filesystem.
From an operational perspective, this vulnerability allows for significant unauthorized access and system compromise. An attacker can exploit this flaw to overwrite critical configuration files, inject web shells into publicly accessible directories, or place malicious scripts in sensitive system folders depending on the privileges under which the gohttpserver process is running. If the server runs with elevated permissions, such as root or administrator rights, the impact escalates from local file manipulation to full remote code execution and complete control over the underlying operating system. Even if run with limited user privileges, the attacker can disrupt service availability by deleting essential files or create persistent backdoors that survive application restarts. This type of attack aligns closely with MITRE ATT&CK techniques related to Initial Access via Valid Accounts or Exploitation for Credential Access and Persistence through File Manipulation, specifically mapping to T1505.003: Web Shell as a persistence mechanism if the attacker places executable content in web-accessible paths.
The root cause is typically found in the code logic that iterates over zip entries and constructs file system paths using simple string concatenation rather than secure path resolution methods. Standard defensive programming practices require resolving the absolute path of both the intended destination directory and the extracted target, then verifying that the resolved target path still begins with the prefix of the allowed base directory. Without this check, any relative component in the zip entry name is interpreted literally by the operating system's file I/O functions, leading to unintended writes outside the sandboxed area. This oversight highlights a common misconception among developers who assume that restricting upload directories at the application level provides sufficient isolation without considering how archive formats can encode path traversal instructions internally.
To mitigate this vulnerability, immediate patching is required as it has been addressed in versions released after 1.3.0. Organizations relying on older instances must implement compensating controls until an upgrade is feasible. These include restricting upload capabilities to trusted users only, implementing strict input validation that rejects any file name containing path traversal characters before processing the archive, and configuring the server process to run with minimal necessary privileges using principles of least privilege. Additionally, deploying a Web Application Firewall (WAF) rule set capable of detecting zip slip patterns in uploaded payloads can provide an additional layer of defense against exploitation attempts from external networks. Regular security audits focusing on file handling operations are essential to prevent similar flaws in other components of the application infrastructure.