CVE-2026-66063: goshs Path Traversal Vulnerability

CVE-2026-66063 Overview

CVE-2026-66063 is a path traversal vulnerability [CWE-22] in goshs, a single-binary file server used by red teamers and developers. Versions prior to 2.1.5 contain a flaw in the httpserver/updown.go multipart upload handler. The handler splits part.FileName() on / but fails to reject .. as a resulting filename. An unauthenticated attacker can upload a file named .., causing filepath.Join to resolve above the served directory and write content outside the intended upload tree.

Critical Impact
Unauthenticated remote attackers can write files outside the server's target directory, enabling file placement in parent paths that may be leveraged for further compromise depending on where goshs runs.

Affected Products

goshs versions prior to 2.1.5
httpserver/updown.go multipart upload handler
httpserver/handler.go file-serving path (related trailing-slash issue fixed in same release)

Discovery Timeline

2026-07-28 - CVE-2026-66063 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-66063

Vulnerability Analysis

The vulnerable upload handler in goshs accepts multipart form data and extracts a filename from each part. The sanitization step splits part.FileName() on the / character and takes the final element as the target filename. While part.FileName() internally applies filepath.Base, that transformation still permits the literal value .. to pass through unchanged.

The handler then calls filepath.Join(targetDir, filename). When filename equals .., filepath.Join resolves to the parent of targetDir. The resulting write operation lands outside the served tree, breaking the isolation the server is expected to enforce.

Because goshs is often started with root or user privileges on ad-hoc red team infrastructure, an attacker may overwrite or create files in the parent directory hierarchy. Impact depends on what files are reachable and what the process is authorized to write.

Root Cause

The root cause is incomplete filename validation. The code performs structural splitting on / but never applies a semantic check against the reserved traversal tokens. Empty strings, ., and .. are all valid outputs of the split-and-take-last pattern, yet each can subvert path containment when passed to filepath.Join.

Attack Vector

An attacker sends a single multipart POST request to the upload endpoint with a Content-Disposition header whose filename field is set to ... No authentication is required. The server writes the request body to the resolved path outside targetDir.

// Patch: httpserver/updown.go — Fix/sendfile trailingslash upload dotdot (#222)
// sanitize filename (No path traversal). part.FileName() already applies
// filepath.Base, but that still lets ".." through, and filepath.Join with
// ".." would resolve to the parent of targetDir — writing outside the
// served tree. Reject any name that is empty, "." or ".." after cleaning.
filenameSlice := strings.Split(part.FileName(), "/")
filenameClean := filenameSlice[len(filenameSlice)-1]

if filenameClean == "" || filenameClean == "." || filenameClean == ".." {
    logger.Warnf("blocked upload with invalid filename %q", part.FileName())
    continue
}

// Block overwriting the .goshs ACL file
if filenameClean == ".goshs" {
    logger.Warnf("blocked attempt to upload file named .goshs")
}

Source: GitHub Commit f3ef599

Detection Methods for CVE-2026-66063

Indicators of Compromise

HTTP POST requests to goshs upload endpoints containing Content-Disposition headers with filename="..", filename=".", or empty filename values.
Files appearing in parent directories of the configured goshs serving root with modification timestamps aligned to upload activity.
Log entries from patched builds containing blocked upload with invalid filename — presence indicates active probing.

Detection Strategies

Inspect web access logs and reverse-proxy telemetry for multipart uploads to goshs instances where the filename metadata contains traversal tokens.
Monitor filesystem events on hosts running goshs for write operations outside the declared served directory.
Correlate process telemetry for the goshs binary with unexpected child file creations in parent paths.

Monitoring Recommendations

Alert on new file creations by the goshs process outside its documented working directory.
Track version strings of deployed goshs binaries and flag any instance reporting a version below 2.1.5.
Log and review all inbound requests to goshs upload endpoints when the tool is exposed to untrusted networks.

How to Mitigate CVE-2026-66063

Immediate Actions Required

Upgrade all goshs deployments to version 2.1.5 or later, which rejects .., ., and empty filenames in multipart uploads.
Audit hosts running earlier versions for files written outside the intended serving directory since the tool was deployed.
Restrict network exposure of goshs instances to trusted operators only until the upgrade is complete.

Patch Information

The fix is delivered in goshs2.1.5 via commit f3ef599e409151d1380866e47de8b1afb0bb54fa. The patched httpserver/updown.go explicitly rejects any filename that resolves to an empty string, ., or .. after splitting. A related change in httpserver/handler.go derives the served filename from stat.Name() rather than req.URL.Path to close a trailing-slash bypass. See the GitHub Security Advisory GHSA-wg2q-39h6-66x9.

Workarounds

Run goshs inside a dedicated, unprivileged directory with no sensitive files in parent paths.
Place goshs behind a reverse proxy that strips or rejects multipart uploads containing traversal tokens in the filename parameter.
Disable the upload feature entirely if only read-only file serving is required for the engagement.

bash

# Verify installed goshs version and upgrade
goshs -v
go install github.com/goshs-labs/goshs@v2.1.5

# Optional: run under a restricted directory with no writable parent content
mkdir -p /srv/goshs-jail && cd /srv/goshs-jail
goshs -d /srv/goshs-jail -p 8000