Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-66063 allows unauthenticated directory traversal and arbitrary file writes in goshs prior to 2․1․5, fixed in version 2․1․5. https://ift.tt/dXLWMRV
Post summary
The text highlights CVE-2026-66063, a directory traversal and file‑write flaw in goshs versions before 2.1.5, and notes it has been fixed in version 2.1.5.
🚨*CVE* CVE-2026-66063 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileNam… https://www.cve.org/CVERecord?id=CVE-2026-66063 ----- Traducción: CVE-2026-66063 gos… http://infoflow.cloud`
Post summary
The text announces CVE-2026-66063 affecting the goshs file server, providing minimal information about the issue, and does not include a PoC, exploitation code, or mitigation details.
CVE-2026-66063 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileNam… https://www.cve.org/CVERecord?id=CVE-2026-66063
Post summary
The post announces CVE-2026-66063 in goshs, detailing a flaw in the multipart upload handler, but offers no evidence of exploitation, remediation, or PoC.