CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

What is CVE-2026-35393?

CVE-2026-35393 is a critical path traversal vulnerability in patrickhener goshs, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.

Weakness: CWE-22

Which versions are affected by CVE-2026-35393?

3 open source packages ship an affected version, including github.com/patrickhener/goshs. It affects 1 product.

Products include Goshs Goshs.

How do I fix CVE-2026-35393?

Upgrade github.com/patrickhener/goshs to 1.1.5-0.20260401172448-237f3af891a9 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-35393 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35393 exists.

Other vulnerabilities in patrickhener goshs

• CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs Critical 9.8
• CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload Critical 9.8
• CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs Critical 9.8
• CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes Critical 9.3
• CVE-2026-40903 Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jg56-wf8x-qrv5, GO-2026-5468.