CVE-2026-66063 goshs-labs CVE debrief

Who should care

Defenders who manage goshs instances should assess exposure and prioritize upgrading to version 2.1.5 if necessary. Defenders should verify if their instances are vulnerable and upgrade accordingly. This vulnerability affects goshs instances, and defenders need to verify if their instances are vulnerable and upgrade accordingly. Defenders should prioritize verifying exposure and upgrading to version 2.1.5 if necessary.

Why it matters

CVE-2026-66063 is a vulnerability in goshs that allows unauthenticated file uploads outside the served tree, potentially leading to security risks. Defenders should prioritize verifying exposure and upgrading to version 2.1.5 if necessary.

• An attacker could potentially upload files outside the intended directory structure.
• This could lead to unauthorized file creation and potential security risks.
• Defenders need to verify if their instances are vulnerable and upgrade accordingly.

Technical summary

The httpserver/updown.go multipart upload handler in goshs prior to 2.1.5 splits part.FileName() on / but does not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue was fixed in version 2.1.5. The vulnerability allows unauthenticated uploads with filenames containing .. to create files outside the served tree, potentially leading to security risks. Defenders should prioritize verifying exposure and upgrading to version 2.1.5 if necessary. The CVE record and NVD entry provide details about the vulnerability, but do not specify which versions are affected or if there are any known exploits.

Defensive priority

Defenders should prioritize verifying if their goshs instances are vulnerable and upgrading to version 2.1.5 if necessary.

Recommended defensive actions

• Verify if the goshs instance is vulnerable by checking the current version.
• Upgrade to version 2.1.5 or later if the current version is vulnerable.
• Monitor for any suspicious uploads or activity on the goshs instance.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but do not specify which versions are affected or if there are any known exploits. The vulnerability was fixed in version 2.1.5. Defenders should verify if their instances are vulnerable and upgrade accordingly. The httpserver/updown.go multipart upload handler in goshs prior to 2.1.5 splits part.FileName() on / but does not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. There are no known exploits, but this

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.