Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
[CVE-2026-35393: CRITICAL] goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.#cve,CVE-2026-35393,#cybersecurity https://cvefind.com/CVE-2026-35393
Post summary
CVE-2026-35393 affects the goshs SimpleHTTPServer prior to 2.0.0-beta.3 due to unsanitized POST multipart uploads, and the flaw has been fixed in that version.
CVE-2026-35393 goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3. https://www.cve.org/CVERecord?id=CVE-2026-35393
Post summary
The post details that CVE-2026-35393, a directory sanitization issue in goshs, is fixed in 2.0.0-beta.3, with no exploit or active use reported.
A path traversal flaw in `goshs` POST multipart upload (CVE-2026-35393) could lead to arbitrary file writes. Validate upload paths and monitor `goshs` for patches. #infosec #pathtraversal #go https://www.pulsepatch.io/posts/cve-2026-35393-goshs-path-traversal
Post summary
A path traversal vulnerability (CVE‑2026‑35393) in `goshs` POST multipart uploads can enable arbitrary file writes, and users are instructed to validate upload paths and watch for vendor patches.
🚨 Critical goshs flaw: CVE-2026-35393 A path traversal issue could allow unauthorized file access and manipulation. Update now and apply extra security controls. 🔗 https://vulert.com/vuln-db/CVE-2026-35393 #CyberSecurity #goshs #CVE202635393 #Vulert https://t.co/AWtfiJsPB4
Post summary
The tweet alerts to a critical path traversal flaw in goshs (CVE‑2026‑35393) and urges an immediate update, linking to a vulnerability database for details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | - | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |