CVE-2026-66063 in goshs
Summary
by MITRE • 07/29/2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The goshs HTTP server represents a versatile tool designed for red team operations and development environments, offering a single-binary solution for file serving capabilities. This vulnerability exists within the multipart upload handler implementation in the httpserver/updown.go file, specifically affecting versions prior to 2.1.5. The flaw stems from inadequate input validation during file name processing where the system splits part.FileName() on forward slash characters without properly sanitizing or rejecting potentially malicious path components.
The technical exploitation occurs through a directory traversal attack vector that leverages the absence of proper validation for special filename sequences. When an attacker submits a multipart upload with a filename containing .. characters, the server fails to reject this input as invalid. This omission allows the system to interpret the .. sequence as a navigation instruction, enabling the creation of files outside the intended serving directory tree. The vulnerability essentially permits arbitrary file placement beyond the designated boundaries, effectively bypassing access controls and potentially leading to unauthorized file system modifications.
This issue represents a classic path traversal vulnerability that aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: PowerShell). The operational impact extends beyond simple file creation, as attackers could potentially overwrite critical system files or establish persistence mechanisms through strategic placement of malicious files in system directories. The vulnerability affects unauthenticated users, meaning any remote attacker can exploit this without requiring valid credentials, significantly increasing the attack surface.
The security implications are particularly concerning for red team environments where such tools might be deployed in sensitive testing scenarios. Organizations using goshs versions prior to 2.1.5 face potential compromise through unauthorized file system modifications that could lead to data exfiltration, system manipulation, or further escalation attacks. The fix implemented in version 2.1.5 addresses this by properly validating and rejecting filename components containing .. sequences, thereby preventing the traversal behavior that enabled the exploit.
Mitigation strategies should include immediate upgrade to goshs version 2.1.5 or later, along with comprehensive security reviews of all file upload handlers within similar applications. Organizations should implement additional layers of protection such as strict input validation, proper access control mechanisms, and regular security testing of file handling components. The vulnerability serves as a reminder of the critical importance of validating user inputs in file system operations and demonstrates how seemingly minor implementation oversights can create significant security risks in development tools used by security professionals.