This vulnerability allows an adversary to upload a file with a crafted filename of ".." via the multipart upload handler, enabling creation of arbitrary files outside the intended serve directory. The flaw resides in the server’s handling of the filename component, making it possible to place files in locations such as configuration directories or system folders. By doing so, an attacker could overwrite critical system files, drop malicious payloads, or otherwise compromise the operating system’s integrity.

The affected product is the goshs file server from goshs-labs, prior to version 2.1.5. All installations of goshs older than 2.1.5 that expose the multipart upload endpoint are vulnerable; newer releases have applied the path‑traversal guard.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is straightforward: an unauthenticated user sends an HTTP multipart upload with a filename containing the ".." sequence, resulting in a path traversal. No special privileges are required, making the flaw accessible to any external actor able to reach the upload endpoint.