Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-66064 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a clea… https://www.cve.org/CVERecord?id=CVE-2026-66064
Post summary
CVE-2026-66064 was disclosed with details on a sendFile handler flaw in older versions of goshs; no PoC, exploit, or patch is mentioned.
🚨*CVE* CVE-2026-66064 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a clea… https://www.cve.org/CVERecord?id=CVE-2026-66064 ----- Traducción: CVE-2026-66064 gos… http://infoflow.cloud`
Post summary
The post reports the existence of CVE‑2026‑66064 in the goshs file server, noting the affected handler and version, but provides no PoC, patch, or evidence of malicious exploitation.