The vulnerability resides in the delete function of goshs, where a path traversal check is performed but the function does not return after the check, allowing selected paths to exceed the intended repository boundary. An attacker who can cause the delete routine to run with file‑system permissions can delete any file reachable by the running process, potentially impacting critical system files, credentials, or logs. The weakness aligns with CWE‑22 and is classified as a high‑severity path traversal exposing data deletion capabilities.

Affected versions are the publicly available releases of the goshs project before the 2.0.0‑beta.3 update, notably 2.0.0‑beta.1 and 2.0.0‑beta.2. The remedy is to upgrade to 2.0.0‑beta.3 or later. Products are hosted by patrickhener and the Go implementation of a simple web server.

The assigned CVSS score of 9.8 reflects the extreme impact of the flaw. With an EPSS score below 1% and no entry in the CISA KEV catalog, the documented likelihood of widespread exploitation remains low, yet the potential damage is severe. It is inferred that the attack vector is likely remote, delivered via HTTP requests to the delete endpoint, but the description does not provide explicit evidence of a remote trigger, so the assumption remains qualified.