Path Traversal Vulnerability in goshs File Server by goshs Labs

CVE-2026-66064

What is CVE-2026-66064?

The goshs file server developed by goshs Labs encountered a path traversal vulnerability that could allow unauthorized access to files. This flaw arose due to the mishandling of the authorization filename, which was derived from the raw request URL path, while the file opening process utilized a sanitized path. This discrepancy meant that adding a trailing slash could bypass access controls defined in the .goshs ACL-file, leading to potential exposure of sensitive files. The issue has been addressed in version 2.1.5, enhancing the security of the goshs file server.

References