GHSA-wg2q-39h6-66x9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wg2q-39h6-66x9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wg2q-39h6-66x9/GHSA-wg2q-39h6-66x9.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-wg2q-39h6-66x9
- Aliases
- Published
- 2026-07-28T22:08:53Z
- Modified
- 2026-08-18T15:11:21Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- goshs has a Path Traversal issue
- Details
-
Summary
The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.
Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393)
The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base).
Suggested fixes
- Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input.
Tooling
AI assistance was used while investigating. The finding was reproduced against a running server on loopback.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2026-07-28T22:08:53Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Go / goshs.de/goshs/v2
Package
- Name
- goshs.de/goshs/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/goshs.de/goshs/v2
Go / github.com/patrickhener/goshs/v2
Package
- Name
- github.com/patrickhener/goshs/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/patrickhener/goshs/v2
Go / goshs.de/goshs
Package
- Name
- goshs.de/goshs
- View open source insights on deps.dev
- Purl
- pkg:golang/goshs.de/goshs
Go / github.com/patrickhener/goshs
Package
- Name
- github.com/patrickhener/goshs
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/patrickhener/goshs