CVE-2026-35393
goshs is a SimpleHTTPServer written in Go.
Published Apr 6, 2026 · updated Jul 24, 2026 · goshs goshs
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 6, 2026 · NIST NVD
Detected
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
Jul 24, 2026 · NIST NVD
Updated
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
Affected
- cpe goshs/goshsversion unspecified
- cpe goshs/goshs2.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-35393
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-35393
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
nvd.nist.gov