Описание
goshs has a Path Traversal issue
Summary
The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.
Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393)
The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base).
Suggested fixes
- Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input.
Tooling
AI assistance was used while investigating. The finding was reproduced against a running server on loopback.
Пакеты
goshs.de/goshs/v2
<= 2.1.4
2.1.5-0.20260727065949-f3ef599e4091
github.com/patrickhener/goshs/v2
<= 2.1.4
2.1.5-0.20260727065949-f3ef599e4091
goshs.de/goshs
<= 1.1.4
Отсутствует
github.com/patrickhener/goshs
<= 1.1.4
Отсутствует
Связанные уязвимости
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.