CVE-2026-66064 - goshs has ACL Bypass & Path Traversal

Back Back to CVE browser

MEDIUM

goshs has ACL Bypass & Path Traversal

Published Jul 28, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

Affected products

Vendor Goshs-Labs Product Goshs Default
unknown
Affected
- < 2.1.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Goshs-Labs	Goshs	unknown	Affected < 2.1.5

github.com/patrickhener/goshs/v2

Go

Introduced 0 Fixed 2.1.5-0.20260727065949-f3ef599e4091
goshs.de/goshs/v2

Go

Introduced 0 Fixed 2.1.5-0.20260727065949-f3ef599e4091
github.com/patrickhener/goshs

Go

Introduced 0 Fixed not fixed
goshs.de/goshs

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Fixed
Go	github.com/patrickhener/goshs/v2	2.1.5-0.20260727065949-f3ef599e4091
Go	goshs.de/goshs/v2	2.1.5-0.20260727065949-f3ef599e4091
Go	github.com/patrickhener/goshs	not fixed
Go	goshs.de/goshs	not fixed

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-22

Path Traversal

CWE-41

CWE-863

Incorrect Authorization

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50083
Advisory
https://github.com/advisories/GHSA-964w-f6gj-5236
Advisory
https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa
x_refsource_MISC
https://github.com/goshs-labs/goshs/pull/222
x_refsource_MISC
https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50083		Advisory
https://github.com/advisories/GHSA-964w-f6gj-5236		Advisory
https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa		x_refsource_MISC
https://github.com/goshs-labs/goshs/pull/222		x_refsource_MISC
https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236		x_refsource_CONFIRM