goshs, a lightweight HTTP server written in Go, is affected by a path traversal vulnerability in its POST multipart upload functionality. The flaw arises because the server does not sanitize filenames supplied in uploads, allowing a crafted request to place files outside the intended upload directory. This flaw can be used to write arbitrary files to the host system, potentially including executable scripts or system configuration files, thereby compromising the confidentiality, integrity, and availability of the server.

All users running patrickhener:goshs older than version 2.0.0‑beta.3 are affected. The issue is present in every release before this patch and has been fixed in 2.0.0‑beta.3.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP POST request to the upload endpoint, an inference made from the described behavior; no direct evidence of exploitation is provided. Due to the high severity and the ease of exploitation in exposed instances, the risk to affected deployments is significant. Mitigation is achieved by applying the patched version or temporarily disabling the upload feature.