CVE-2026-35392 | patrickhener goshs up to 2.0.0-beta.2 httpserver/updown.go path traversal (GHSA-g8mv-vp7j-qp64)

VDB-355696 · CVE-2026-35392 · GHSA-G8MV-VP7J-QP64 PATRICKHENER GOSHS UP TO 2.0.0-BETA.2 HTTPSERVER/UPDOWN.GO PATH TRAVERSAL HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 8.4 $0-$5k 1.15+ Summaryinfo A vulnerability described as critical has been identified in patrickhener goshs up to 2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file httpserver/updown.go. Executing a manipulation can lead to path traversal. This vulnerability is handled as CVE-2026-35392. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended. Detailsinfo A vulnerability was found in patrickhener goshs up to 2.0.0-beta.2. It has been declared as critical. This vulnerability affects an unknown code block of the file httpserver/updown.go. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes: goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-35392 since 04/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006. Upgrading to version 2.0.0-beta.3 eliminates this vulnerability. Productinfo Vendor patrickhener Name goshs Version 2.0.0-beta.0 2.0.0-beta.1 2.0.0-beta.2 Website Product: https://github.com/patrickhener/goshs/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 8.5 VulDB Meta Temp Score: 8.4 VulDB Base Score: 7.3 VulDB Temp Score: 7.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 9.8 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Path traversal CWE: CWE-22 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: goshs 2.0.0-beta.3 Timelineinfo 04/02/2026 CVE reserved 04/06/2026 +4 days Advisory disclosed 04/06/2026 +0 days VulDB entry created 04/06/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-g8mv-vp7j-qp64 Status: Confirmed CVE: CVE-2026-35392 (🔒) GCVE (CVE): GCVE-0-2026-35392 GCVE (VulDB): GCVE-100-355696 Entryinfo Created: 04/06/2026 23:59 Changes: 04/06/2026 23:59 (65) Complete: 🔍 Cache ID: 99:EAC:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸