CVE-2026-66064 in goshs
Summary
by MITRE • 07/29/2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The goshs HTTP server presents a critical access control vulnerability that undermines its security model for red team operations and development environments. This flaw exists in the httpserver/handler.go file where the sendFile handler demonstrates inconsistent path handling between authorization and file access operations. The vulnerability stems from the server's implementation where it processes file paths through filepath.Clean() for actual file opening operations while simultaneously using the raw req.URL.Path for ACL validation and block-list checks. This discrepancy creates an exploitable condition where malicious actors can manipulate URL paths to bypass security controls that should prevent access to restricted files.
The technical exploitation occurs through the manipulation of trailing slashes in HTTP requests, a common technique that leverages path normalization differences between systems. When a request contains a trailing slash in the URL path, the server's authorization logic fails to properly validate against the ACL files because it compares against the raw uncleaned path rather than the normalized version used for file access. This inconsistency allows attackers to bypass .goshs protection mechanisms that rely on file-based access control lists and block-lists to restrict access to sensitive content or system resources. The vulnerability directly relates to CWE-22 Path Traversal and CWE-285 Improper Authorization, representing a fundamental flaw in how the server handles path validation and access control enforcement.
The operational impact of this vulnerability extends beyond simple file access bypass as it compromises the core security assumptions of any red team tool that relies on controlled access to resources. In penetration testing environments where goshs serves as a staging server for payloads or sensitive reconnaissance data, an attacker could gain unauthorized access to files that should remain protected by the ACL system. This weakness undermines the integrity of security controls typically expected from tools used in adversarial operations where maintaining operational security and controlling information flow is paramount. The vulnerability affects not only file confidentiality but also potentially enables further exploitation through privilege escalation or information disclosure attacks that leverage the bypassed access controls.
Mitigation strategies for this vulnerability require immediate patching to version 2.1.5 which addresses the path normalization inconsistency in the sendFile handler. Organizations should implement comprehensive path validation checks that normalize all URL paths before performing authorization decisions, ensuring consistency between how paths are processed for file access and security validation. Additional defensive measures include implementing strict input sanitization for all HTTP request paths and establishing monitoring for unusual path manipulation patterns. The fix should also incorporate automated testing of path handling behavior to prevent similar issues in future development cycles. Security teams should review existing goshs configurations and verify that all ACL files are properly configured and that no unauthorized access paths exist in the system's attack surface, aligning with ATT&CK technique T1078 Valid Accounts and T1566 Phishing for Information to prevent unauthorized access through path manipulation vulnerabilities.