CVE-2026-35393 | patrickhener goshs up to 2.0.0-beta.2 Multipart Upload path traversal (GHSA-jg56-wf8x-qrv5)

VDB-355697 · CVE-2026-35393 · GHSA-JG56-WF8X-QRV5 PATRICKHENER GOSHS UP TO 2.0.0-BETA.2 MULTIPART UPLOAD PATH TRAVERSAL HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 8.4 $0-$5k 1.03+ Summaryinfo A vulnerability classified as critical has been found in patrickhener goshs up to 2.0.0-beta.2. Affected by this issue is some unknown functionality of the component Multipart Upload Handler. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2026-35393. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component. Detailsinfo A vulnerability was found in patrickhener goshs up to 2.0.0-beta.2. It has been rated as critical. This issue affects some unknown processing of the component Multipart Upload Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is: goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-35393 since 04/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue. Upgrading to version 2.0.0-beta.3 eliminates this vulnerability. Productinfo Vendor patrickhener Name goshs Version 2.0.0-beta.0 2.0.0-beta.1 2.0.0-beta.2 Website Product: https://github.com/patrickhener/goshs/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 8.5 VulDB Meta Temp Score: 8.4 VulDB Base Score: 7.3 VulDB Temp Score: 7.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 9.8 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Path traversal CWE: CWE-22 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: goshs 2.0.0-beta.3 Timelineinfo 04/02/2026 CVE reserved 04/06/2026 +4 days Advisory disclosed 04/06/2026 +0 days VulDB entry created 04/06/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-jg56-wf8x-qrv5 Status: Confirmed CVE: CVE-2026-35393 (🔒) GCVE (CVE): GCVE-0-2026-35393 GCVE (VulDB): GCVE-100-355697 Entryinfo Created: 04/06/2026 23:59 Changes: 04/06/2026 23:59 (65) Complete: 🔍 Cache ID: 99:985:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸