CVE-2026-66063: Path Traversal Arbitrary File Write and Access Control Bypass in goshs

goshs is a file server built in Go designed to facilitate file sharing and directory serving. It features administrative facilities, such as path-based access control list (ACL) rules stored in .goshs files, to restrict resource access. Unauthenticated users can access the server's public endpoints, including the multipart upload handler.\n\nThis security report covers CVE-2026-66063, a medium-severity directory traversal flaw in the multipart upload parser. In parallel, researchers addressed an access control bypass issue involving path-canonicalization differences when handling trailing slashes. Both flaws permit attackers to subvert the configured directory restrictions.

The root cause of CVE-2026-66063 resides in the upload utility function located inside httpserver/updown.go. When a multipart upload is initiated, the server retrieves the client-supplied filename from the request headers. The application attempts to prevent directory traversal by splitting the path string on forward slash characters and selecting the final slice element.\n\nThis sanitization pattern fails to handle input where the final element of the path is a double-dot (..) sequence. When an attacker provides a filename of '..', the splitting logic extracts '..' as the sanitized filename. The server then executes filepath.Join with targetDir and the traversal sequence, returning the parent folder of the served root.\n\nFinally, the code appends a trailing tilde character to the resolved destination path to create a temporary write location. The application calls os.Create on this out-of-bounds destination. Consequently, the application writes the uploaded content to a file located outside the served directory structure.

Prior to version 2.1.5, the path cleaning logic in httpserver/updown.go used the following sequence:\n\ngo\nfilenameSlice := strings.Split(part.FileName(), \"/\")\nfilenameClean := filenameSlice[len(filenameSlice)-1]\n\nif filenameClean == \".goshs\" {\n logger.Warnf(\"blocked attempt to upload file named .goshs\")\n continue\n}\n\nfinalPath := filepath.Join(targetDir, filenameClean)\ntempPath := finalPath + \"~\"\ndst, err := os.Create(tempPath)\n\n\nThe code contains no validation to reject empty strings, single dots, or double dots. The developers resolved this in commit f3ef599e409151d1380866e47de8b1afb0bb54fa by implementing boundary checks on the extracted filename:\n\ngo\nif filenameClean == \"\" || filenameClean == \".\" || filenameClean == \"..\" {\n logger.Warnf(\"blocked upload with invalid filename %q\", part.FileName())\n continue\n}\n\n\nAdditionally, a defense-in-depth sanitization layer was added using the sanitizePath function. This validates that the resolved absolute path of the uploaded file resides within the boundary of the target directory:\n\ngo\nif _, err := sanitizePath(targetDir, filenameClean); err != nil {\n logger.Warnf(\"blocked upload escaping target directory: %q\", part.FileName())\n continue\n}\n

To exploit CVE-2026-66063, an unauthenticated attacker sends an HTTP POST request targeting the /upload endpoint. The payload is structured as multipart/form-data. The attacker specifies a filename attribute of '..' within the content disposition header.\n\nhttp\nPOST /upload HTTP/1.1\nHost: vulnerable-goshs-server:8000\nContent-Type: multipart/form-data; boundary=---------------------------97384973289\n\n-----------------------------97384973289\nContent-Disposition: form-data; name=\"files\"; filename=\"..\"\nContent-Type: text/plain\n\nPAYLOAD_CONTENT\n-----------------------------97384973289--\n\n\nThe server receives this request, processes the part, and creates a temporary file appended with a tilde in the parent directory of targetDir. For instance, if targetDir is /opt/shared, the server writes the payload to /opt/shared~.\n\nTo exploit the trailing slash access control bypass, an attacker issues a GET request targeting a restricted file name appended with a trailing slash, such as /blocked/secret.txt/. The server checks the URI segment which resolves to an empty string, bypasses the blocklist, and subsequently uses Go's file system handler to open and return the blocked file.

The primary impact of CVE-2026-66063 is unauthenticated arbitrary file write capabilities. However, because the server appends a trailing tilde character to the target path, the attacker cannot overwrite arbitrary existing files directly. They are instead restricted to creating new files with a trailing tilde in the parent directory of the served web root.\n\nThe secondary impact is the exposure of sensitive files protected by directory-level ACLs. Attackers can bypass access controls to download private files, such as internal keys or configuration files, by appending a trailing slash to the target path. The combined effect of these vulnerabilities lowers the overall security posture of the host system.\n\nThe CVSS v3.1 base score is 6.5, reflecting a medium-severity rating. The attack vector is Network, complexity is Low, and no privileges are required to perform the exploits.

The most effective remediation is upgrading the goshs installation to version 2.1.5 or newer. This version resolves the directory traversal vulnerability by rejecting invalid filename patterns and validates path canonicalization.\n\nIf upgrading is not immediately possible, apply the following mitigations:\n\n* Interface Binding: Bind the goshs server to the loopback interface (127.0.0.1) instead of public interfaces to prevent external access.\n* Reverse Proxy Normalization: Implement a reverse proxy, such as Nginx or Caddy, configured to sanitize URI paths. Ensure the proxy cleans trailing slashes and blocks double-dot traversal sequences before passing requests to the backend.