{"id":"GHSA-wg2q-39h6-66x9","summary":"goshs has a Path Traversal issue","details":"## Summary\n\nThe multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.\n\n## Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393)\n\nThe multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects \"..\". Uploading with filename=\"..\" results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base).\n\n## Suggested fixes\n\n1. Reject any upload filename that is \"..\", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input.\n\n## Tooling\n\nAI assistance was used while investigating. The finding was reproduced against a running server on loopback.","aliases":["CVE-2026-66063","GO-2026-6137"],"modified":"2026-08-18T15:11:21.878856857Z","published":"2026-07-28T22:08:53Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-28T22:08:53Z","nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9"},{"type":"WEB","url":"https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"},{"type":"PACKAGE","url":"https://github.com/goshs-labs/goshs"}],"affected":[{"package":{"name":"goshs.de/goshs/v2","ecosystem":"Go","purl":"pkg:golang/goshs.de/goshs/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.5-0.20260727065949-f3ef599e4091"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wg2q-39h6-66x9/GHSA-wg2q-39h6-66x9.json"}},{"package":{"name":"github.com/patrickhener/goshs/v2","ecosystem":"Go","purl":"pkg:golang/github.com/patrickhener/goshs/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.5-0.20260727065949-f3ef599e4091"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wg2q-39h6-66x9/GHSA-wg2q-39h6-66x9.json"}},{"package":{"name":"goshs.de/goshs","ecosystem":"Go","purl":"pkg:golang/goshs.de/goshs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wg2q-39h6-66x9/GHSA-wg2q-39h6-66x9.json"}},{"package":{"name":"github.com/patrickhener/goshs","ecosystem":"Go","purl":"pkg:golang/github.com/patrickhener/goshs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wg2q-39h6-66x9/GHSA-wg2q-39h6-66x9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}