Upstream information

CVE-2026-66063 at MITRE

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v3 Scores
CVSS detail CNA (GitHub)
Base Score 6.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1273390 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)

SUSE Timeline for this CVE

CVE page created: Tue Aug 4 12:06:04 2026
CVE page last modified: Wed Nov 4 17:43:40 2026