CVE-2026-35392
goshs is a SimpleHTTPServer written in Go.
Published Apr 6, 2026 · updated Jul 24, 2026 · goshs goshs
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 6, 2026 · NIST NVD
Detected
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
Jul 24, 2026 · NIST NVD
Updated
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
Affected
- cpe goshs/goshsversion unspecified
- cpe goshs/goshs2.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-35392
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-35392
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
nvd.nist.gov