The goshs SimpleHTTPServer allows an attacker to upload files via a POST multipart request without sanitizing the supplied file path. This oversight permits the creation or overwrite of files outside the intended upload directory, potentially enabling remote code execution or the placement of malicious artifacts on the host. The weakness represents a classic Path Traversal scenario.

The flaw affects the open‑source goshs server maintained by patrickhener. Any deployment running a version older than 2.0.0‑beta.3 is vulnerable because the POST upload handler did not constrain the pathname. Versions 2.0.0‑beta.3 and later contain the patch that enforces a restricted upload directory.

With a CVSS score of 9.8, the vulnerability is classified as critical. Although the EPSS score is currently below 1% and the issue is not listed in the CISA KEV catalog, the threat remains significant because an unauthenticated attacker can trigger the flaw via a standard HTTP POST to an exposed server, potentially achieving remote code execution. Administrators should treat this as a high‑risk exposure pending a security update.