CVE-2026-66064CWE-41CWE-863

goshs has ACL Bypass & Path Traversal

Medium · published July 28, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00308 · 23.3th percentile
Weaknesses
CWE-41 · Improper Resolution of Path Equivalence; CWE-863 · Incorrect Authorization
Published
2026-07-28T22:12Z
EPSS history
Timeline
  • 28 JUL 22:12Z
    goshs has ACL Bypass & Path Traversal
    cvelistv5