CVE-2026-66064

🗓️ 28 Jul 2026 22:12:04Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

Goshs before 2.1.5 allows access control bypass and path traversal via raw URL path in sendFile.

Reporter	Title	Published	Views	Family All 100
attackerkb	CVE-2026-66064	28 Jul 202622:12	–	attackerkb
Circl	CVE-2026-66064	28 Jul 202623:31	–	circl
Cvelist	CVE-2026-66064 goshs has ACL Bypass & Path Traversal	28 Jul 202622:12	–	cvelist
EUVD	EUVD-2026-50083	28 Jul 202622:12	–	euvd
Github Security Blog	goshs has ACL Bypass & Path Traversal	28 Jul 202622:26	–	github
Mend	CVE-2026-66064	28 Jul 202622:12	–	mend
NVD	CVE-2026-66064	28 Jul 202623:17	–	nvd
osv_ghsa	GHSA-964W-F6GJ-5236 goshs has ACL Bypass & Path Traversal	28 Jul 202622:26	–	osv_ghsa
osv_go	GO-2026-6134 goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs	18 Aug 202614:32	–	osv_go
osv_opensuse	OPENSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb	4 Sep 202612:30	–	osv_opensuse

Vulners

Node

goshs goshsRange<2.1.5

[
  {
    "vendor": "goshs-labs",
    "product": "goshs",
    "versions": [
      {
        "version": "< 2.1.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236
github	www.github.com/goshs-labs/goshs/pull/222
github	www.github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa

Parameter	Position	Path	Description	CWE
req.URL.Path	path	/<path>	A trailing slash in the URL path can bypass ACL-file protection and block-list checks because the authorization filename is derived from the raw path while the file is opened using a cleaned path.	CWE-41, CWE-863

30 Jul 2026 19:19Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.3

EPSS0.00445

SSVC