patrickhener CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL patrickhener CVE published 2026-04-06

CVE-2026-35471

The goshs SimpleHTTPServer written in Go has a path traversal vulnerability prior to version 2.0.0-beta.3. The tdeleteFile() function was missing a return statement after a path traversal check, allowing for potential directory traversal attacks. This issue has been fixed in version 2.0.0-beta.3. Users of goshs SimpleHTTPServer version prior to 2.0.0-beta.3 should update to the latest version to prevent p [truncated]

CRITICAL patrickhener CVE published 2026-04-06

CVE-2026-35392

A critical vulnerability was discovered in goshs, a SimpleHTTPServer written in Go. The vulnerability exists in the PUT upload functionality in httpserver/updown.go, where path sanitization is not performed. This allows an attacker to potentially upload files to arbitrary locations on the server. The vulnerability was fixed in version 2.0.0-beta.3.