CyberRota Analysis
AI-GeneratedThe multipart upload handler in goshs prior to version 2.1.5 is vulnerable to unauthenticated file uploads, allowing attackers to exploit the filename parameter to create files outside the intended directory structure. This could lead to unauthorized access or manipulation of sensitive files on the server. Organizations using affected versions should prioritize updating to version 2.1.5 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.