critical9.8
CVE-2026-35471
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/patrickhener/goshs | < 1.1.5-0.20260401172448-237f3af891a9 | 1.1.5-0.20260401172448-237f3af891a9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Goshs | Goshs | before 2.0.0 Version 2.0.0 |