CVE-2026-66064: goshs has ACL Bypass & Path Traversal

July 28, 2026

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

References

github.com/advisories/GHSA-964w-f6gj-5236
github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa
github.com/goshs-labs/goshs/pull/222
github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236
nvd.nist.gov/vuln/detail/CVE-2026-66064

Code Behaviors & Features

Detect and mitigate CVE-2026-66064 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →