CVE-2026-35392

The vulnerability is located in the httpserver/updown.go file responsible for handling PUT requests. When uploading a file, the server does not verify or sanitize the target path provided by the client. An attacker can craft an HTTP PUT request containing path traversal sequences (e.g., '../../../'), which allow writing a file outside the server's designated working directory.

An attacker can write arbitrary files to any location in the file system accessible to the goshs process, which may lead to violations of confidentiality, integrity and availability of the system — including malicious code execution through overwriting critical configuration or binary files.

Goshs should be updated to version 2.0.0-beta.3 or newer, in which the vulnerability has been fixed. Until the update is applied, it is recommended to restrict network access to the goshs instance only to trusted hosts and disable PUT upload functionality if not required.

Goshs in all versions before 2.0.0-beta.3