Nixpkgs security tracker
NIXPKGS-2026-2308
GitHub issue
published 5 hours ago
goshs: security issues < 2.1.5
Permalink
CVE-2026-66063
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
goshs has a Path Traversal issue
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
References
Affected products
goshs
- ==< 2.1.5
Package maintainers
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@SEIAROTg SEIAROTg
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
Permalink
CVE-2026-66064
5.3 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
goshs has ACL Bypass & Path Traversal
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
References
-
https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236 x_refsource_CONFIRM
-
https://github.com/goshs-labs/goshs/pull/222 x_refsource_MISC
Affected products
goshs
- ==< 2.1.5
Package maintainers
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@SEIAROTg SEIAROTg
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>