CVE-2026-66064

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa
https://github.com/goshs-labs/goshs/pull/222
https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) goshs es un servidor de archivos de un solo binario rico en funciones para equipos rojos y desarrolladores. Antes de la versión 2.1.5, el gestor sendFile de httpserver/handler.go abría archivos usando una ruta saneada pero derivaba el nombre de archivo de autorización de req.URL.Path en bruto, por lo que una barra diagonal final podría eludir la protección de archivos ACL de .goshs y las comprobaciones de la lista de bloqueo. Este problema está corregido en la versión 2.1.5.

Information

Published : 2026-07-28 23:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-66064

Mitre link : CVE-2026-66064

CVE.ORG link : CVE-2026-66064

JSON object : View

Products Affected

No product.

CWE

CWE-41

Improper Resolution of Path Equivalence

CWE-863

Incorrect Authorization

{"id": "CVE-2026-66064", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66064", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:44:31.270872Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "goshs-labs", "product": "goshs", "versions": [{"status": "affected", "version": "< 2.1.5"}]}]}], "published": "2026-07-28T23:17:10.490", "references": [{"url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa", "source": "security-advisories@github.com"}, {"url": "https://github.com/goshs-labs/goshs/pull/222", "source": "security-advisories@github.com"}, {"url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-41"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."}, {"lang": "es", "value": "goshs es un servidor de archivos de un solo binario rico en funciones para equipos rojos y desarrolladores. Antes de la versi\u00f3n 2.1.5, el gestor sendFile de httpserver/handler.go abr\u00eda archivos usando una ruta saneada pero derivaba el nombre de archivo de autorizaci\u00f3n de req.URL.Path en bruto, por lo que una barra diagonal final podr\u00eda eludir la protecci\u00f3n de archivos ACL de .goshs y las comprobaciones de la lista de bloqueo. Este problema est\u00e1 corregido en la versi\u00f3n 2.1.5."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}