CVE-2026-35393

BRIEFING NOTE: CVE-2026-35393 goshs, a SimpleHTTPServer implementation written in Go, contains a critical path traversal vulnerability in versions prior to 2.0.0-beta.3 where the POST multipart upload directory is not properly sanitized. This flaw allows attackers to upload files to arbitrary locations on the server, potentially compromising system integrity. The vulnerability carries a CVSS 3.0 score of 9.8 CRITICAL due to its network-based attack vector requiring no authentication, low attack complexity, and high impact across confidentiality, integrity, and availability. An unauthenticated remote attacker can exploit this weakness with minimal effort to read, modify, or delete sensitive files. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on the Hot List. The EPSS score of 0.0004 indicates very low probability of near-term exploitation, suggesting this may represent a prospective or hypothetical CVE entry. Organizations using goshs should prioritize upgrading to version 2.0.0-beta.3 or later as a precautionary measure.