CVE-2026-35471 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-35471 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2026-35471) has been identified in the goshs package by Patrick Hener, allowing unauthenticated users to delete arbitrary files and directories on affected servers. This vulnerability arises from a missing return statement in the deleteFile() function, enabling path traversal attacks without any authentication or special flags.

Immediate Action

  • Immediately patch your goshs installation if you are using it.
  • Isolate affected services to limit exposure while remediation is in progress.
  • Review your application logs for any suspicious activity related to file deletions.
  • Implement input validation to restrict file deletions to within the webroot.
  • Monitor for updates from the maintainer regarding a fixed version.
  • Consider disabling the file deletion feature until a patch is applied.

Affected Versions

  • goshs@<=1.0.0 vulnerable; upgrade to 1.0.1+

Resolution Guide

To patch the vulnerability, you should upgrade to a fixed version of the goshs package. Use the following command:

go get github.com/patrickhener/goshs@1.0.1

For hardening your configuration, ensure that the following checks are in place:

if !strings.HasPrefix(fileCleaned, fs.Webroot) {
    w.WriteHeader(403)
    return
}

This additional check will ensure that only files within the designated webroot can be deleted.

Detection & Verification

To check if your version of goshs is vulnerable, run:

go list -m all | grep github.com/patrickhener/goshs

To verify that the fix is applied, you can attempt to access the deletion endpoint with a path traversal attempt and ensure that it returns a 403 Forbidden status instead of allowing the deletion.

Risk and Impact

The vulnerability allows attackers to perform arbitrary deletions on the server, potentially leading to loss of critical data or service disruption. The risk is particularly high for solo developers and small teams who may not have robust security measures in place, as it could lead to significant operational and reputational damage.

```

Keep reading