Path Sanitization Issue in goshs SimpleHTTPServer by patrickhener
CVE-2026-35392

9.8CRITICAL

Key Information:

Vendor

Patrickhener

Status
Goshs
Vendor
CVE Published:
6 April 2026

What is CVE-2026-35392?

The goshs SimpleHTTPServer, developed by patrickhener, is susceptible to a critical path sanitization issue in its PUT upload functionality. When utilizing versions prior to 2.0.0-beta.3, users may inadvertently allow unauthorized file uploads due to insufficient validation of the upload paths. This oversight in the handling of uploaded content poses a risk of exposing the server to various security threats, including file system interference or data leakage. It is crucial for users to upgrade to the latest version to mitigate these risks.

Affected Version(s)

goshs < 2.0.0-beta.3

References

https://github.com/patrickhener/goshs/security/advisories...
x_refsource_CONFIRM

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.