Loading story…
Two high-severity vulnerabilities, CVE-2026-35392 and CVE-2026-35393, were disclosed in goshs, a Go-based SimpleHTTPServer, affecting versions prior to 2.0.0-beta.3. Both issues are classified as CWE-22 path traversal flaws that arise from missing pathname sanitization in file upload functionality: PUT upload handling in httpserver/updown.go and POST multipart upload directory processing. The weaknesses could allow remote, unauthenticated attackers to write files outside intended directories.
Both CVEs carry the same CVSS v3 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability. The vulnerabilities were addressed in 2.0.0-beta.3, and related GitHub security advisories were published alongside the fixes. Organizations using goshs for file upload workflows should prioritize upgrading and review exposed instances for unauthorized file placement or tampering.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A third path traversal vulnerability in goshs, CVE-2026-35471, was publicly recorded for versions prior to 2.0.0-beta.3. The flaw stems from a missing return in tdeleteFile() after a path traversal check, allowing unauthorized file access or modification; the issue is fixed in version 2.0.0-beta.3.
Two vulnerabilities in goshs were publicly recorded: CVE-2026-35392 for path traversal in PUT uploads and CVE-2026-35393 for path traversal in POST multipart uploads. The disclosures note high-impact consequences for confidentiality, integrity, and availability, and reference a related GitHub security advisory.
The goshs project fixed two path traversal vulnerabilities affecting versions prior to 2.0.0-beta.3: one in PUT upload handling in httpserver/updown.go and another in the POST multipart upload directory handling. Both issues could allow unauthorized file access or modification due to missing path sanitization.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting multiple pre-release and stable versions. `CVE-2026-34581` impacts versions `1.1.0` through before `2.0.0-beta.2` and allows attackers to abuse the Share Token feature to bypass download restrictions. The flaw can expose broader goshs functionality beyond intended file access controls and may lead to **code execution**. The issue is classified as `CWE-288` and was fixed in `2.0.0-beta.2`. A second flaw, `CVE-2026-40903`, affects goshs versions before `2.0.0-beta.6` and is described as an **ArtiPACKED** vulnerability that can leak `GITHUB_TOKEN` values through GitHub Actions workflow artifacts, even when the token does not appear in repository source code. The issue is mapped to `CWE-829` and carries high confidentiality and integrity impact, extending concern from application access control to CI/CD credential exposure. The vendor lists `2.0.0-beta.6` as the fix version, and a GitHub security advisory has been published.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-64863** affects **goshs** before version **2.1.4**, allowing unauthenticated remote attackers to bypass the server’s `--no-delete` and `--upload-only` protections through flawed WebDAV request handling. The issue stems from `MOVE` being treated as a write-only method without properly enforcing deletion restrictions, while `COPY` operations were also insufficiently constrained. An attacker could use crafted WebDAV requests to move, overwrite, or effectively delete files, including by sending `MOVE` requests with the `Overwrite: T` header. The flaw is classified as **CWE-284** and has been rated high to critical severity, with reports citing **CVSS 9.1** and a published vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`. The vendor fixed the issue in **goshs 2.1.4** through commit `0444ac6b1a8176ddae70d940adf7a26b2e5a6c29`, adding a dedicated `webdavGuard` middleware to enforce separate restrictions for `MOVE` and `COPY`. Reporting also noted residual edge cases involving broken symbolic links and possible path-normalization discrepancies, underscoring the need for users to upgrade promptly.
Jul 29, 2026
A high-severity vulnerability tracked as **CVE-2026-73034** affects **eosphoros-ai DB-GPT** up to and including version **0.8.1**, allowing unauthenticated attackers to exploit the Python file-upload endpoint by placing directory traversal sequences in the `user_id` HTTP header. The flaw lets remote attackers escape the intended upload directory and write arbitrary files anywhere on the server, creating broad risk to confidentiality, integrity, and availability under the published **CVSS 3.1** vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Advisories warn that attackers could place controlled files in sensitive locations such as Python startup hooks, cron directories, or agent scripts, potentially escalating the arbitrary file write into **remote code execution**. A security patch in the DB-GPT repository hardens the upload logic by restricting `user_id` to alphanumeric characters, underscores, and hyphens, resolving uploads only under the `python_uploads` base directory, and enforcing containment checks to block traversal, TOCTOU, and symlink-based escapes; added tests also verify rejection of traversal payloads and unsafe path conditions.
Aug 12, 2026