Answer in brief
CVE-2026-66063 records a Medium severity path traversal vulnerability in goshs has a Path Traversal issue. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-66063 records a Medium severity path traversal vulnerability in goshs has a Path Traversal issue. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update github.com/patrickhener/goshs/v2 to 2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs/v2 to 2.1.5-0.20260727065949-f3ef599e4091 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-66063 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/patrickhener/goshsgo | <=1.1.4 | Not reported |
| github.com/patrickhener/goshs/v2go | <=2.1.4 | 2.1.5-0.20260727065949-f3ef599e4091 |
| goshs.de/goshsgo | <=1.1.4 | Not reported |
| goshs.de/goshs/v2go | <=2.1.4 | 2.1.5-0.20260727065949-f3ef599e4091 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-66063 records a Medium severity path traversal vulnerability in goshs has a Path Traversal issue. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2, goshs.de/goshs.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/patrickhener/goshs/v2 to 2.1.5-0.20260727065949-f3ef599e4091; goshs.de/goshs/v2 to 2.1.5-0.20260727065949-f3ef599e4091 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-66063 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/patrickhener/goshsgo | <=1.1.4 | Not reported |
| github.com/patrickhener/goshs/v2go | <=2.1.4 | 2.1.5-0.20260727065949-f3ef599e4091 |
| goshs.de/goshsgo | <=1.1.4 | Not reported |
| goshs.de/goshs/v2go | <=2.1.4 | 2.1.5-0.20260727065949-f3ef599e4091 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-66063 records a Medium severity path traversal vulnerability in goshs has a Path Traversal issue. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2, goshs.de/goshs.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. ## Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393) The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base). ## Suggested fixes 1. Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input. ## Tooling AI assistance was used while investigating. The finding was reproduced against a running server on loopback.
## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. ## Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393) The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base). ## Suggested fixes 1. Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input. ## Tooling AI assistance was used while investigating. The finding was reproduced against a running server on loopback.