CVE-2026-35471

The deleteFile() function performs path validation checks for path traversal, but does not terminate code execution after detecting an invalid path — there is a missing return statement. As a result, further processing of the request is continued despite negative validation, allowing an attacker to manipulate the path (e.g., using '../' sequences) to escape the server's working directory and operate on arbitrary system files.

A remote, unauthenticated attacker can read, modify, or delete any files accessible to the server process, leading to violations of data confidentiality, integrity, and availability.

Update Goshs to version 2.0.0-beta.3 or later, in which the vulnerability has been fixed. Details are available in the project repository and in the GHSA-6qcc-6q27-whp8 security advisory.

Goshs (github.com/patrickhener/goshs) in versions prior to 2.0.0-beta.3