goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.

Affected: Go: github.com/patrickhener/goshs

### Summary * POST multipart upload directory not sanitized | `httpserver/updown.go:71-174`

This finding affect the default configuration, no flags or authentication required.

### Details

**File:** `httpserver/updown.go:71-174` **Trigger:** `POST /<path>/upload` (server.go:49-51 checks `HasSuffix(r.URL.Path, "/upload")`)

The filename is sanitized (slashes stripped, line 105-106), but the target directory comes from `req.URL.Path` unsanitized:

```go upath := req.URL.Path // unsanitized

targetpath := strings.Split(upath, "/") targetpath = targetpath[:len(targetpath)-1] // strips trailing "upload" target := strings.Join(targetpath, "/")

filenameSlice := strings.Split(part.FileName(), "/") filenameClean := filenameSlice[len(filenameSlice)-1] // filename sanitized

finalPath := fmt.Sprintf("%s%s/%s", fs.UploadFolder, target, filenameClean) ```

The route requires the URL to end with `/upload`. An attacker uses a path like `/../../target_dir/upload`, the suffix satisfies routing, and the `../..` escapes the webroot. The filename on disk is controlled by the attacker via the multipart `filename` field (after basename extraction).

**Impact:** Unauthenticated arbitrary file write to any existing directory on the filesystem.

**PoCs:** ```bash #!/usr/bin/env bash # # Example: # ./arbitrary_overwrite2.sh 10.0.0.5 8080

set -euo pipefail

HOST="${1:?Usage: $0 <host> <port> <local-file> <absolute-target-path>}" PORT="${2:?Usage: $0 <host> <…

goshs-2.0.0-1.1 on GA media