goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-35393: 0.65% estimated exploitation activity in the next 30 days; percentile 51.20 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary POST multipart upload directory not sanitized | httpserver/updown.go:71-174 This finding affect the default configuration, no flags or authentication required. Details File: httpserver/updown.go:71-174 Trigger: POST /<path/upload (server.go:49-51 checks HasSuffix(r.URL.Path, "/upload")) The filename is sanitized (slashes stripped, line 105-106), but the target directory comes from req.URL.Path unsanitized: The route requires the URL to end with /upload. An attacker uses a path like /../../targetdir/upload, the suffix satisfies routing, and the ../.. escapes the webroot. The filename on disk is controlled by the attacker via the multipart filename field (after basename extraction). Impact: Unauthenticated arbitrary file write to any existing directory on the filesystem. PoCs: To execute it: ./arbitraryoverwrite2.sh 10.1.2.2 8000 ./canary /tmp/can --- Recommendations Checking that the targeted file is part of the webroot could prevent these attacks. Also, ensure that the method…

Published by the source

3 Apr 2026, 04:08 UTC

Last modified by the source

6 Apr 2026, 23:43 UTC

Source last checked

26 Oct 2026, 15:19 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-jg56-wf8x-qrv5

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-35393

Advisory: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
IDs: CVE-2026-35393, GHSA-jg56-wf8x-qrv5
Record: https://patchnext.com/advisories/cve-2026-35393 (revision 1, source checked 26 Oct 2026, 15:19 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/patrickhener/goshs 1.1.5-0.20260401172448-237f3af891a9. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/patrickhener/goshs: affected < 1.1.5-0.20260401172448-237f3af891a9; fixed in 1.1.5-0.20260401172448-237f3af891a9

## Suggested inspection (read-only)
- Go github.com/patrickhener/goshs: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/patrickhener/goshs.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-jg56-wf8x-qrv5 (GitHub-reviewed advisory GHSA-jg56-wf8x-qrv5 lists affected ranges: Go github.com/patrickhener/goshs >=0 <1.1.5-0.20260401172448-237f3af891a9)

Commands are suggestions: review each one before running it.