PT-2026-65626 · Goshs · Goshs

CVE-2026-66064 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5

Description The sendFile function in the httpserver/handler.go file incorrectly derives the authorization filename from the raw req.URL.Path while opening the file using a cleaned path. This discrepancy allows an attacker to bypass the .goshs ACL-file protection and block-list checks by appending a trailing slash to the request path, which results in an empty derived name. This can lead to the unauthorized disclosure of the .goshs ACL file, including sensitive information such as bcrypt hashes, or access to files explicitly listed in the block list.

Recommendations Update to version 2.1.5.

Fix

Incorrect Authorization

Path traversal

Weakness Enumeration

CWE-863

CWE-41

CWE-22

Related Identifiers

CVE-2026-66064

GHSA-964W-F6GJ-5236

Affected Products

Goshs

References · 6

• https://osv.dev/vulnerability/GHSA-964w-f6gj-5236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-66064 · Security Note
• https://github.com/goshs-labs/goshs/pull/222 · Note
• https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa · Note
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236 · Note
• https://github.com/goshs-labs/goshs · Note