CVE-2026-35392: Goshs Path Traversal Vulnerability

CVE-2026-35392 Overview

CVE-2026-35392 is a critical path traversal vulnerability affecting goshs, a SimpleHTTPServer implementation written in Go. The vulnerability exists in the PUT upload functionality within httpserver/updown.go, where insufficient path sanitization allows attackers to write files to arbitrary locations on the server's file system. This flaw enables remote attackers to potentially overwrite critical system files or deploy malicious payloads outside the intended upload directory.

Critical Impact
Remote attackers can exploit the lack of path sanitization in PUT upload requests to write arbitrary files anywhere on the server, potentially leading to complete system compromise, arbitrary code execution, or data destruction.

Affected Products

goshs versions prior to 2.0.0-beta.3
goshs 2.0.0-beta1
goshs 2.0.0-beta2

Discovery Timeline

2026-04-06 - CVE-2026-35392 published to NVD
2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35392

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The flaw resides in the file upload handling code within httpserver/updown.go, where user-supplied path components in PUT requests are not properly validated or sanitized before being used to construct file system paths.

When processing PUT upload requests, the goshs server fails to filter or normalize path sequences such as ../ (dot-dot-slash) that allow navigation outside the intended upload directory. This enables an attacker to craft malicious requests that traverse the directory structure and write files to arbitrary locations accessible by the server process.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction, making it particularly dangerous for exposed goshs instances.

Root Cause

The root cause is the absence of path canonicalization and validation in the PUT upload handler. The httpserver/updown.go module directly uses user-controlled path input without stripping or rejecting directory traversal sequences. Proper security controls would include normalizing the path, resolving it to an absolute path, and verifying that the final destination remains within the designated upload directory boundary.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted PUT request to a vulnerable goshs server. By including path traversal sequences (e.g., ../) in the upload path, the attacker can escape the intended upload directory and write files to arbitrary locations on the server's file system.

The attack can be executed remotely over the network without any authentication requirements or user interaction. Successful exploitation could allow an attacker to overwrite configuration files, inject malicious scripts into web-accessible directories, or plant backdoor files for persistent access. In scenarios where the goshs server runs with elevated privileges, this could lead to complete system compromise.

Detection Methods for CVE-2026-35392

Indicators of Compromise

Unexpected files appearing outside the designated goshs upload directory
Web server access logs containing PUT requests with path traversal sequences such as ../ or URL-encoded variants (%2e%2e%2f)
Modified system or configuration files with timestamps corresponding to goshs server activity
Presence of suspicious or unknown files in sensitive directories like /etc, /var, or application directories

Detection Strategies

Monitor HTTP access logs for PUT requests containing directory traversal patterns (../, ..%2f, %2e%2e/, etc.)
Implement file integrity monitoring on critical system directories to detect unauthorized modifications
Deploy web application firewalls (WAF) with rules to block path traversal attempts in request paths
Use intrusion detection systems to alert on anomalous file write operations by the goshs process

Monitoring Recommendations

Enable detailed logging for the goshs server to capture all PUT request paths and source IPs
Configure SIEM rules to correlate PUT requests with subsequent file system changes outside approved directories
Implement real-time alerting for any file creation or modification in directories that should be read-only or restricted

How to Mitigate CVE-2026-35392

Immediate Actions Required

Upgrade goshs to version 2.0.0-beta.3 or later immediately
If immediate upgrade is not possible, disable PUT upload functionality or restrict network access to the goshs server
Review file system for any unauthorized files that may have been uploaded through exploitation
Restrict the goshs server's file system permissions to limit the directories it can write to

Patch Information

The vulnerability is fixed in goshs version 2.0.0-beta.3. Users should update to this version or any subsequent release. For detailed patch information and the security advisory, refer to the GitHub Security Advisory GHSA-g8mv-vp7j-qp64.

Workarounds

Disable PUT upload functionality in goshs configuration until the patch can be applied
Place goshs behind a reverse proxy that filters requests containing path traversal patterns
Run goshs in a containerized or sandboxed environment with strict file system access controls
Use network segmentation to limit access to the goshs server to trusted networks only

bash

# Example: Run goshs with restricted directory permissions
# Create a dedicated upload directory with limited scope
mkdir -p /opt/goshs/uploads
chown goshs-user:goshs-user /opt/goshs/uploads
chmod 750 /opt/goshs/uploads

# Run goshs as unprivileged user to limit impact
su - goshs-user -c "goshs -d /opt/goshs/uploads"