CVE-2026-66064

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66064", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-23T23:25:28.897Z", "datePublished": "2026-07-28T22:12:04.830Z", "dateUpdated": "2026-07-29T15:24:11.484Z"}, "containers": {"cna": {"title": "goshs has ACL Bypass & Path Traversal", "problemTypes": [{"descriptions": [{"cweId": "CWE-41", "lang": "en", "description": "CWE-41: Improper Resolution of Path Equivalence", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236"}, {"name": "https://github.com/goshs-labs/goshs/pull/222", "tags": ["x_refsource_MISC"], "url": "https://github.com/goshs-labs/goshs/pull/222"}, {"name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"}], "affected": [{"vendor": "goshs-labs", "product": "goshs", "versions": [{"version": "< 2.1.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T22:12:04.830Z"}, "descriptions": [{"lang": "en", "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."}], "source": {"advisory": "GHSA-964w-f6gj-5236", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T14:44:31.270872Z", "id": "CVE-2026-66064", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T15:24:11.484Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:44:31.270872Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:44:34.650Z"}}], "cna": {"title": "goshs has ACL Bypass & Path Traversal", "source": {"advisory": "GHSA-964w-f6gj-5236", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "goshs-labs", "product": "goshs", "versions": [{"status": "affected", "version": "< 2.1.5"}]}], "references": [{"url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236", "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/goshs-labs/goshs/pull/222", "name": "https://github.com/goshs-labs/goshs/pull/222", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa", "name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-41", "description": "CWE-41: Improper Resolution of Path Equivalence"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T22:12:04.830Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66064", "state": "PUBLISHED", "dateUpdated": "2026-07-29T15:24:11.484Z", "dateReserved": "2026-07-23T23:25:28.897Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T22:12:04.830Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "goshs", "vendor": "goshs-labs", "versions": [{"status": "affected", "version": "< 2.1.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."}, {"lang": "es", "value": "goshs es un servidor de archivos de un solo binario rico en funciones para equipos rojos y desarrolladores. Antes de la versi\u00f3n 2.1.5, el gestor sendFile de httpserver/handler.go abr\u00eda archivos usando una ruta saneada pero derivaba el nombre de archivo de autorizaci\u00f3n de req.URL.Path en bruto, por lo que una barra diagonal final podr\u00eda eludir la protecci\u00f3n de archivos ACL de .goshs y las comprobaciones de la lista de bloqueo. Este problema est\u00e1 corregido en la versi\u00f3n 2.1.5."}], "id": "CVE-2026-66064", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66064", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T14:44:31.270872Z", "version": "2.0.3"}}]}, "published": "2026-07-28T23:17:10.490", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"}, {"source": "security-advisories@github.com", "url": "https://github.com/goshs-labs/goshs/pull/222"}, {"source": "security-advisories@github.com", "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-41"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.5)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "goshs", "source": "cna", "vendor": "goshs-labs"}, "product": "goshs", "vendor": "goshs"}], "created": "2026-07-30T15:29:12.094592+00:00", "updated": "2026-08-04T23:30:15.891398+00:00", "vendors": ["goshs", "goshs$PRODUCT$goshs"]}