goshs, a lightweight HTTP server written in Go, contains a flaw in its PUT upload handler that fails to sanitize the supplied pathname. As a result, a client can issue a crafted HTTP PUT request that instructs the server to write a file to any path that the server process can access. This allows an attacker to create new files or overwrite existing ones, potentially altering configuration files, adding malicious scripts, or otherwise modifying the server’s filesystem in a way that could compromise the integrity of the application or host.

The affected product is goshs, maintained by patrickhener. All releases older than 2.0.0-beta.3 lack the necessary path‑sanitization logic in the upload routine. The issue was addressed in version 2.0.0-beta.3 and later releases. No other vendors or product lines are listed as affected.

The flaw carries a CVSS score of 9.8, categorizing it as critical. Because the only requirement for exploitation is a crafted HTTP PUT request, it can be performed from any host that can reach the server’s HTTP endpoint. The lack of a known EPSS value and absence from the KEV catalog suggest it has not yet been widely exploited, but the high score and ease of exploitation give it a high likelihood of real‑world impact for exposed instances.