---
id: CVE-2026-66063
aliases:
  - GHSA-wg2q-39h6-66x9
title: goshs has a Path Traversal issue
summary: goshs has a Path Traversal issue
severity: medium
cvss: 6.5
cwe:
  - CWE-22
vendor: goshs
product: goshs.de/goshs/v2
ecosystem: go
affected:
  - goshs.de/goshs/v2 <= 2.1.4
  - github.com/patrickhener/goshs/v2 <= 2.1.4
  - goshs.de/goshs <= 1.1.4
  - github.com/patrickhener/goshs <= 1.1.4
patched:
  - goshs.de/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091
  - github.com/patrickhener/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091
published: '2026-07-28'
updated: '2026-07-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wg2q-39h6-66x9'
references:
  - url: >-
      https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9
  - url: >-
      https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa
  - url: 'https://github.com/advisories/GHSA-wg2q-39h6-66x9'
tags:
  - ghsa
  - go
ingestedAt: '2026-07-28T22:40:03.266Z'
epss: 0.00233
epssPercentile: 0.14427
---

## Overview

## Summary

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

## Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393)

The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base).

## Suggested fixes

1. Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input.

## Tooling

AI assistance was used while investigating. The finding was reproduced against a running server on loopback.

## Affected packages

- `goshs.de/goshs/v2 <= 2.1.4`
- `github.com/patrickhener/goshs/v2 <= 2.1.4`
- `goshs.de/goshs <= 1.1.4`
- `github.com/patrickhener/goshs <= 1.1.4`

## Remediation

Upgrade to a patched release:

- `goshs.de/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091`
- `github.com/patrickhener/goshs/v2 2.1.5-0.20260727065949-f3ef599e4091`