CVE-2026-35392

CVE-2026-35392 is a critical path traversal vulnerability in goshs, a SimpleHTTPServer implementation written in Go, affecting versions prior to 2.0.0-beta.3. The flaw exists in the PUT upload functionality within httpserver/updown.go due to insufficient input sanitization, allowing attackers to upload files to arbitrary locations on the affected system. The vulnerability carries a CVSS severity rating of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. Successful exploitation could result in complete compromise of system confidentiality, integrity, and availability through arbitrary file placement. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.0004 indicates extremely low probability of exploitation relative to other CVEs, and the community attention level remains inactive. Organizations running goshs should upgrade to version 2.0.0-beta.3 or later despite the low current exploitation activity, given the critical severity rating.