Platform
go
Component
github.com/patrickhener/goshs
Fixed in
2.0.1
1.1.5-0.20260401172448-237f3af891a9
CVE-2026-35471 describes a critical Path Traversal vulnerability discovered in goshs, a Go-based server for accessing and managing files on a network share. This flaw allows unauthenticated attackers to read arbitrary files on the server by manipulating the delete endpoint. The vulnerability affects versions prior to 1.1.5-0.20260401172448-237f3af891a9, and a patch is now available.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's file system. This could include configuration files, source code, database credentials, or any other data stored on the system. Successful exploitation could lead to complete compromise of the server and its data. The lack of authentication requirements makes this vulnerability particularly dangerous, as any user can potentially exploit it. The vulnerability's location within the file deletion handler suggests an attacker could potentially gain access to files they shouldn't have permission to delete, leading to data loss or corruption if combined with other exploits.
CVE-2026-35471 was publicly disclosed on 2026-04-03. No known KEV listing or EPSS score is currently available. Public proof-of-concept (PoC) code is likely to emerge given the vulnerability's simplicity and the lack of authentication requirements. Monitor security advisories and threat intelligence feeds for updates on exploitation activity.
Exploit Status
EPSS
0.11% (29% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-35471 is to immediately upgrade to version 1.1.5-0.20260401172448-237f3af891a9 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /delete endpoint using a web application firewall (WAF) or proxy server. Configure the WAF to block requests containing .. in the path. Carefully review and restrict file system permissions to minimize the potential impact of a successful attack. Monitor access logs for suspicious activity, particularly requests to the /delete endpoint with unusual paths.
Actualice goshs a la versión 2.0.0-beta.3 o superior para mitigar la vulnerabilidad de recorrido de ruta. Esta versión corrige la falta de verificación adecuada de la ruta del archivo, previniendo el acceso no autorizado a archivos fuera del directorio restringido.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-35471 is a critical vulnerability in goshs allowing attackers to read arbitrary files due to a missing return statement after a path traversal check in the file deletion handler.
You are affected if you are running goshs versions prior to 1.1.5-0.20260401172448-237f3af891a9. Assess your environment and upgrade immediately.
Upgrade to version 1.1.5-0.20260401172448-237f3af891a9 or later. As a temporary workaround, restrict access to the /delete endpoint using a WAF or proxy.
While no active exploitation has been confirmed, the vulnerability's simplicity and lack of authentication make it likely to be targeted. Monitor security advisories and threat intelligence feeds.
Refer to the goshs project's repository and associated security advisories for the latest information and updates regarding CVE-2026-35471.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.