CVE-2026-35471

CVE-2026-35471 affects goshs, a SimpleHTTPServer implementation written in Go, in versions prior to 2.0.0-beta.3. The vulnerability stems from a missing return statement in the tdeleteFile() function following a path traversal check, which could allow an attacker to bypass security controls and delete arbitrary files on the affected system. The vulnerability carries a CVSS 3.0 score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is severe across all three security dimensions: attackers could gain high-level confidentiality, integrity, and availability compromises, potentially enabling complete system compromise. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and its inactive status on vulnerability hot lists. The EPSS score of 0.0004 suggests a low probability of exploitation in real-world scenarios. Organizations running goshs prior to version 2.0.0-beta.3 should prioritize updating to the patched version despite low current exploitation activity, given the critical severity rating.