{"vulnerability": "cve-2026-66064", "sightings": [{"uuid": "bb6ebd12-6d46-4a89-913d-c7e47d003d6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66064", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mrwn7o3vxa2d", "content": "goshs: fix CVE-2026-66063 and CVE-2026-66064\n\nhttps://github.com/NixOS/nixpkgs/pull/547661\n\n#security", "creation_timestamp": "2026-07-31T09:27:20.751573Z"}, {"uuid": "1fe88a2f-0abe-44ea-8ed9-a6fa3ae3a8f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66064", "type": "seen", "source": "https://gist.github.com/alon710/3d4b381ed70bde1d61201f63076c47f0", "content": "# CVE-2026-66064: CVE-2026-66064: Incorrect Authorization and ACL Bypass via Trailing Slash in goshs\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66064\n\n## Summary\nCVE-2026-66064 is an access control list (ACL) and blocklist bypass vulnerability in the goshs file server prior to version 2.1.5. Due to an inconsistency between uncleaned raw URI path evaluation and normalized file access, remote unauthenticated attackers can retrieve protected files, including the configuration file containing password hashes, by appending a trailing slash to the requested path.\n\n## TL;DR\nA trailing slash on request paths allows remote attackers to bypass goshs ACLs and blocklists, exposing sensitive configuration files and password hashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-41\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **Exploit Status**: PoC / Regression Tests Available\n- **Impact**: Partial Confidentiality Loss\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs file server prior to version 2.1.5\n- **goshs**: < 2.1.5 (Fixed in: `2.1.5`)\n\n## Mitigation\n\n- Upgrade the goshs binary to version 2.1.5 or later to apply the official patch.\n- Deploy WAF rules or reverse proxy policies to filter and reject HTTP request paths ending in .goshs/ or other restricted targets with a trailing slash.\n- Restrict the binding interface of goshs to localhost (127.0.0.1) unless external access is strictly required.\n\n**Remediation Steps:**\n1. Identify all running instances of goshs in the environment and determine their current version.\n2. Build or download goshs version 2.1.5 using 'go install github.com/goshs-labs/goshs@v2.1.5'.\n3. Replace the old goshs binary with the updated version and restart the file server.\n4. Rotate any bcrypt hashes stored in .goshs configuration files that were exposed to potential exploit attempts.\n\n## References\n\n- [GHSA-964w-f6gj-5236: Security Bypass / Incorrect Authorization in goshs](https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236)\n- [Pull Request #222: Fix security bypass in sendFile](https://github.com/goshs-labs/goshs/pull/222)\n- [Fix Commit f3ef599](https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa)\n- [CVE Record for CVE-2026-66064](https://www.cve.org/CVERecord?id=CVE-2026-66064)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66064) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T23:31:57.716330Z"}, {"uuid": "cd78db6c-e2a0-4172-a8a1-a4dedaa34a4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66064", "type": "seen", "source": "https://gist.github.com/alon710/3d4b381ed70bde1d61201f63076c47f0", "content": "# CVE-2026-66064: CVE-2026-66064: Incorrect Authorization and ACL Bypass via Trailing Slash in goshs\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-66064\n\n## Summary\nCVE-2026-66064 is an access control list (ACL) and blocklist bypass vulnerability in the goshs file server prior to version 2.1.5. Due to an inconsistency between uncleaned raw URI path evaluation and normalized file access, remote unauthenticated attackers can retrieve protected files, including the configuration file containing password hashes, by appending a trailing slash to the requested path.\n\n## TL;DR\nA trailing slash on request paths allows remote attackers to bypass goshs ACLs and blocklists, exposing sensitive configuration files and password hashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-41\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **Exploit Status**: PoC / Regression Tests Available\n- **Impact**: Partial Confidentiality Loss\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs file server prior to version 2.1.5\n- **goshs**: < 2.1.5 (Fixed in: `2.1.5`)\n\n## Mitigation\n\n- Upgrade the goshs binary to version 2.1.5 or later to apply the official patch.\n- Deploy WAF rules or reverse proxy policies to filter and reject HTTP request paths ending in .goshs/ or other restricted targets with a trailing slash.\n- Restrict the binding interface of goshs to localhost (127.0.0.1) unless external access is strictly required.\n\n**Remediation Steps:**\n1. Identify all running instances of goshs in the environment and determine their current version.\n2. Build or download goshs version 2.1.5 using 'go install github.com/goshs-labs/goshs@v2.1.5'.\n3. Replace the old goshs binary with the updated version and restart the file server.\n4. Rotate any bcrypt hashes stored in .goshs configuration files that were exposed to potential exploit attempts.\n\n## References\n\n- [GHSA-964w-f6gj-5236: Security Bypass / Incorrect Authorization in goshs](https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236)\n- [Pull Request #222: Fix security bypass in sendFile](https://github.com/goshs-labs/goshs/pull/222)\n- [Fix Commit f3ef599](https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa)\n- [CVE Record for CVE-2026-66064](https://www.cve.org/CVERecord?id=CVE-2026-66064)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-66064) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T00:00:29.018481Z"}]}