CVE-2026-35471Disclosure(goshs / goshs)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch goshs goshs systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.

goshs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/patrickhener/goshs/security/advisories/GHSA-6qcc-6q27-whp8

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

goshs

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-04-06); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

goshs

Products

goshs

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Disclosure

360.0%

Patch

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-04	1	Disclosure1
2026-04-06	3	Disclosure1Patch2
2026-04-07	1	Disclosure1

Full discourse5 posts

Vulmon Vulnerability Feed@VulmonFeeds185d
Disclosure
CVE-2026-35471 Path Traversal Vulnerability in goshs SimpleHTTPServer Prior to 2.0.0-beta.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35471
Post summary
The text announces CVE-2026-35471 as a path‑traversal flaw in goshs SimpleHTTPServer versions before 2.0.0‑beta.3 and provides a link for further details.
0000035
4.0K followersView on X
CVEFind.com@CveFindCom185d
Patch
[CVE-2026-35471: CRITICAL] goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.#cve,CVE-2026-35471,#cybersecurity https://cvefind.com/CVE-2026-35471
Post summary
The message announces a critical path traversal flaw in goshs prior to version 2.0.0‑beta.3, noting it has been fixed in that release.
0000065
619 followersView on X
CVE@CVEnew185d
Patch
CVE-2026-35471 goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3. https://www.cve.org/CVERecord?id=CVE-2026-35471
Post summary
CVE-2026-35471 is a path‑traversal flaw in the Go-based goshs SimpleHTTPServer, fixed in version 2.0.0‑beta.3; no PoC, exploit code, or active attacks are disclosed.
00000284
57.0K followersView on X
0day Signal@0dayPublishing185d
Disclosure
🚨 CVE-2026-35471: Improper Limitation of a Pathnam... Missing return statement after path traversal validation lets attackers delete arbitrary files on the server - classic ... https://zerodaysignal.com/vulnerability/CVE-2026-35471 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-35471, highlighting a missing return statement after path traversal validation that permits arbitrary file deletion on the server. No PoC, exploit code, or patch information is provided.
0000063
204 followersView on X
PulsePatch.io@pulsepatchio187d
Disclosure
A critical path traversal flaw (CVE-2026-35471) impacts `goshs`, potentially allowing unauthorized file access. Review usage contexts and strengthen input validation. #PathTraversal #infosec https://www.pulsepatch.io/posts/cve-2026-35471-goshs-path-traversal
Post summary
The text announces a path traversal vulnerability (CVE‑2026‑35471) in goshs that could enable unauthorized file access, providing only high‑level technical details without mentioning a PoC, tool, or patch.
0000044
11 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	goshs	goshs	-	go	-
App	goshs	goshs	2.0.0	go	-
App	goshs	goshs	2.0.0	go	-

Explore more

Back to dashboard goshs CVEs goshs vulnerabilities

What researchers are saying

CVE-2026-35471

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE-2026-35471 as a path‑traversal flaw in goshs SimpleHTTPServer versions before 2.0.0‑beta.3 and provides a link for further details.

CVEFind.com@CveFindComPatch

The message announces a critical path traversal flaw in goshs prior to version 2.0.0‑beta.3, noting it has been fixed in that release.

CVE@CVEnewPatch

CVE-2026-35471 is a path‑traversal flaw in the Go-based goshs SimpleHTTPServer, fixed in version 2.0.0‑beta.3; no PoC, exploit code, or active attacks are disclosed.

0day Signal@0dayPublishingDisclosure

The post announces CVE-2026-35471, highlighting a missing return statement after path traversal validation that permits arbitrary file deletion on the server. No PoC, exploit code, or patch information is provided.

PulsePatch.io@pulsepatchioDisclosure

The text announces a path traversal vulnerability (CVE‑2026‑35471) in goshs that could enable unauthorized file access, providing only high‑level technical details without mentioning a PoC, tool, or patch.