goshs, a lightweight HTTP server written in Go, allows clients to upload files with the HTTP PUT method without sanitizing the requested pathname. This omission permits an attacker to craft filenames that reference directories outside the intended upload directory, effectively creating or overwriting arbitrary files on the server's filesystem. The resulting vulnerability is a classic path traversal flaw that can compromise data integrity, confidentiality, and potentially enable remote code execution if the written files are executable or are placed in sensitive locations.

The vulnerability exists in the patrickhener:goshs product and affects all releases prior to 2.0.0‑beta.3, including the 2.0.0‑beta.1 and 2.0.0‑beta.2 builds. The issue was addressed in version 2.0.0‑beta.3, which introduces pathname sanitization and limits upload operations to the designated directory.

With a CVSS score of 9.8 the flaw is classified as critical; the EPSS score below 1% indicates low current exploitation likelihood, but the vulnerability remains exploitable over an open network via unauthenticated HTTP PUT requests to any publicly reachable goshs instance. The flaw is not listed in the CISA KEV catalog, yet its high severity warrants immediate attention to prevent potential system compromise.