VulnSocial

CVE-2026-35392Disclosure(goshs / goshs)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch goshs goshs systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.

goshs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • goshs

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-04-06)
  • 3 total mentions across 2 days

Affected systems

Vendors
goshs
Products
goshs

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-03: 1Mentions · 2026-04-06: 2Patch / Workaround · 2026-04-06: 2Technical Details · 2026-04-03: 1Technical Details · 2026-04-06: 204-0304-06
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-031
Disclosure1
2026-04-062
Disclosure1Patch1
Full discourse3 posts
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-35392: CRITICAL] goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.#cve,CVE-2026-35392,#cybersecurity https://cvefind.com/CVE-2026-35392

    Post summary

    A critical path‑sanitization flaw in the Go-based SimpleHTTPServer 'goshs' allows unrestricted PUT uploads, announced as CVE‑2026‑35392 and fixed in version 2.0.0‑beta.3.

    0000058
    619 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-35392 goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-be… https://www.cve.org/CVERecord?id=CVE-2026-35392

    Post summary

    The post identifies a path‑sanitization flaw in goshs’ PUT upload feature and confirms that a patch is available in a newer release.

    00000208
    57.0K followersView on X
  • PulsePatch.io@pulsepatchio
    Disclosure

    A critical path traversal flaw (CVE-2026-35392) affects `goshs` PUT upload, enabling arbitrary file writes. This could lead to system compromise. Monitor for `goshs` security updates. #PathTraversal #InfoSec #CyberSecurity https://www.pulsepatch.io/posts/cve-2026-35392-goshs-path-traversal

    Post summary

    The post announces a path traversal flaw in goshs PUT uploads that allows arbitrary file writes, but provides no proof of concept, exploit code, or patch details.

    0000039
    10 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appgoshsgoshs-go-
Appgoshsgoshs2.0.0go-
Appgoshsgoshs2.0.0go-

Explore more

Back to dashboardgoshs CVEsgoshs vulnerabilities