CVE-2026-35393

When handling a POST request with multipart data (file upload), the application does not sanitize the target directory path. An attacker can submit a specially crafted request containing path traversal sequences (e.g., '../'), allowing the file to be written to any location in the file system accessible to the server process. The attack does not require authentication or user interaction.

An attacker can write arbitrary files to unauthorized locations in the file system, potentially leading to data confidentiality and integrity violations, and in extreme cases — to code execution or system compromise (e.g., by overwriting configuration files or startup scripts).

Goshs should be updated to version 2.0.0-beta.3 or newer, where the vulnerability has been fixed. Until the update is applied, it is recommended to restrict network access to the Goshs instance to trusted hosts only.

Goshs in versions earlier than 2.0.0-beta.3