CVE-2026-35392
goshs, a simple HTTP server written in Go, had a critical path traversal flaw that let anyone upload files to arbitrary locations. The issue was fixed in version 2.0.0‑beta.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
goshs SimpleHTTPServer (any version before 2.0.0‑beta.3).
Real-world impact
An attacker could upload files to any directory on the server, potentially overwriting critical files, installing malware, or creating backdoors, leading to full compromise of the host.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable remotely without authentication, with no user interaction, and gives an attacker complete control over the server’s file system, affecting confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade goshs to version 2.0.0‑beta.3 or later.
- 022. Restart the goshs service to apply the update.
NVD-referenced vendor advisory
Timeline
- Apr 6, 2026 · Apr 6, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/patrickhener/goshs/security…exploitmitigationvendor advisory