CVE-2026-35393: Goshs Path Traversal Vulnerability

CVE-2026-35393 Overview

CVE-2026-35393 is a critical path traversal vulnerability in goshs, a SimpleHTTPServer written in Go. Prior to version 2.0.0-beta.3, the POST multipart upload directory is not properly sanitized, allowing attackers to write files to arbitrary locations on the target system. This vulnerability has been fixed in version 2.0.0-beta.3.

Critical Impact

Unauthenticated remote attackers can exploit this path traversal flaw to upload files to arbitrary directories outside the intended upload path, potentially leading to remote code execution, system compromise, or data destruction.

Affected Products

• goshs versions prior to 2.0.0-beta.3
• goshs 2.0.0-beta1
• goshs 2.0.0-beta2

Discovery Timeline

• 2026-04-06 - CVE-2026-35393 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35393

Vulnerability Analysis

This vulnerability arises from improper input validation in the multipart file upload functionality of goshs. When processing file uploads via POST requests, the application fails to sanitize the directory path specified in the multipart form data. This allows an attacker to use directory traversal sequences (such as ../) to escape the intended upload directory and write files to arbitrary locations on the file system.

The vulnerability is particularly severe because goshs is designed as a simple file server that may be deployed with elevated privileges or in sensitive environments. Successful exploitation requires no authentication and can be performed remotely over the network, making this a highly exploitable attack surface.

Root Cause

The root cause is a classic CWE-22 (Path Traversal) vulnerability where user-controlled input in the multipart upload request is not properly validated or sanitized before being used to construct file paths. The application directly concatenates user-supplied directory names without stripping or rejecting path traversal characters like .., /, or \.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted POST multipart upload request to the goshs server. By including directory traversal sequences in the upload path parameter, the attacker can direct the server to write uploaded files to locations outside the designated upload directory.

The attack can be executed remotely over the network without any authentication. Potential exploitation scenarios include:

• Writing malicious scripts to web-accessible directories
• Overwriting configuration files to modify application behavior
• Placing executable files in startup directories for persistence
• Overwriting critical system files to cause denial of service

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35393

Indicators of Compromise

• Unexpected files appearing in directories outside the goshs upload path
• POST requests to goshs containing ../ or similar traversal sequences in multipart form data
• Web server logs showing unusual file upload requests with encoded path characters (%2e%2e%2f)
• Modified system or configuration files with timestamps corresponding to goshs activity

Detection Strategies

• Monitor HTTP POST requests to goshs endpoints for path traversal patterns in multipart form data
• Implement web application firewall (WAF) rules to detect and block ../ sequences in upload parameters
• Audit file system changes in directories that should not receive uploads from goshs
• Deploy file integrity monitoring on critical system directories

Monitoring Recommendations

• Enable detailed logging for all goshs file operations including upload paths
• Configure alerts for any file write operations outside the designated upload directory
• Monitor network traffic for multipart POST requests containing suspicious path patterns
• Regularly review goshs access logs for anomalous upload activity

How to Mitigate CVE-2026-35393

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.3 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling goshs file upload functionality
• Audit systems for any signs of exploitation or unauthorized file modifications
• Review file system permissions to limit the impact of potential path traversal attacks

Patch Information

The vulnerability is fixed in goshs version 2.0.0-beta.3. Users should upgrade to this version or later to remediate the vulnerability. The fix implements proper sanitization of the multipart upload directory path before file operations.

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Run goshs with minimal file system permissions to limit the scope of potential exploitation
• Deploy goshs behind a reverse proxy that filters path traversal sequences in requests
• Restrict network access to goshs to trusted IP addresses only
• Use containerization or sandboxing to isolate goshs from sensitive file system areas

# Configuration example: Run goshs with restricted permissions
# Create a dedicated user with limited privileges
useradd -r -s /bin/false goshs-user

# Set restrictive permissions on upload directory
mkdir -p /var/goshs/uploads
chown goshs-user:goshs-user /var/goshs/uploads
chmod 750 /var/goshs/uploads

# Run goshs as the restricted user
sudo -u goshs-user goshs -d /var/goshs/uploads