{"id":"CVE-2026-66063","aliases":["GHSA-wg2q-39h6-66x9"],"title":"goshs has a Path Traversal issue","summary":"goshs has a Path Traversal issue","severity":"medium","cvss":6.5,"cwe":["CWE-22"],"vendor":"goshs","product":"goshs.de/goshs/v2","ecosystem":"go","affected":["goshs.de/goshs/v2 <= 2.1.4","github.com/patrickhener/goshs/v2 <= 2.1.4","goshs.de/goshs <= 1.1.4","github.com/patrickhener/goshs <= 1.1.4"],"patched":["goshs.de/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091","github.com/patrickhener/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wg2q-39h6-66x9","references":[{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9"},{"url":"https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"},{"url":"https://github.com/advisories/GHSA-wg2q-39h6-66x9"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-28T22:40:03.266Z","epss":0.00233,"epssPercentile":0.14409,"slug":"CVE-2026-66063","body":"## Overview\n\n## Summary\n\nThe multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.\n\n## Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393)\n\nThe multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects \"..\". Uploading with filename=\"..\" results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base).\n\n## Suggested fixes\n\n1. Reject any upload filename that is \"..\", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input.\n\n## Tooling\n\nAI assistance was used while investigating. The finding was reproduced against a running server on loopback.\n\n## Affected packages\n\n- `goshs.de/goshs/v2 <= 2.1.4`\n- `github.com/patrickhener/goshs/v2 <= 2.1.4`\n- `goshs.de/goshs <= 1.1.4`\n- `github.com/patrickhener/goshs <= 1.1.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `goshs.de/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091`\n- `github.com/patrickhener/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}