{"uuid": "01c61fe2-9e69-4257-a1d1-94efaa6e8a18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wg2q-39h6-66x9", "type": "seen", "source": "https://gist.github.com/alon710/9b6eb86646df2d26df9c07ebf0051d99", "content": "# CVE-2026-66063: CVE-2026-66063: Path Traversal Arbitrary File Write and Access Control Bypass in goshs\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66063\n\n## Summary\nCVE-2026-66063 is an unauthenticated directory traversal and arbitrary file write vulnerability in goshs before version 2.1.5. Due to improper sanitization of file upload names, an unauthenticated attacker can write files outside the served web root. A related trailing slash bypass in the same version allows unauthorized file retrieval.\n\n## TL;DR\nAn unauthenticated path traversal vulnerability in the goshs multipart upload handler allows arbitrary file writes outside the served directory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 6.5\n- **Exploit Status**: PoC level\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- goshs server deployments with upload functionality enabled\n- **goshs**: < 2.1.5 (Fixed in: `2.1.5`)\n\n## Mitigation\n\n- Upgrade goshs to version 2.1.5 or newer\n- Bind goshs to localhost (127.0.0.1) to limit exposure\n- Employ a reverse proxy with strict URI normalization\n\n**Remediation Steps:**\n1. Download the latest goshs release (version 2.1.5 or higher)\n2. Replace existing goshs binaries with the secure version\n3. Restart the goshs service\n\n## References\n\n- [GHSA-wg2q-39h6-66x9](https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9)\n- [Fix Commit Patch](https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa)\n- [CVE Record Database](https://www.cve.org/CVERecord?id=CVE-2026-66063)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66063) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T06:32:35.136703Z"}