{"id":"CVE-2026-66064","sourceIdentifier":"security-advisories@github.com","published":"2026-07-28T23:17:10.490","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."},{"lang":"es","value":"goshs es un servidor de archivos de un solo binario rico en funciones para equipos rojos y desarrolladores. Antes de la versión 2.1.5, el gestor sendFile de httpserver/handler.go abría archivos usando una ruta saneada pero derivaba el nombre de archivo de autorización de req.URL.Path en bruto, por lo que una barra diagonal final podría eludir la protección de archivos ACL de .goshs y las comprobaciones de la lista de bloqueo. Este problema está corregido en la versión 2.1.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goshs-labs","product":"goshs","versions":[{"version":"< 2.1.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-29T14:44:31.270872Z","id":"CVE-2026-66064","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-41"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa","source":"security-advisories@github.com"},{"url":"https://github.com/goshs-labs/goshs/pull/222","source":"security-advisories@github.com"},{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236","source":"security-advisories@github.com"}]}