Security readout for executives and security teams
Plain-English summary
goshs versions before 2.1.5 can expose files that access-control rules were intended to protect. An unauthenticated remote requester may bypass certain ACL-file and block-list checks by exploiting inconsistent path handling. The documented impact is limited confidentiality loss, not file modification or service disruption.
Executive priority
Prioritize internet-facing or sensitive-data deployments for prompt upgrade. This is not documented as actively exploited, but unauthenticated remote access and simple path handling make delayed remediation avoidable. Lower-exposure internal instances can follow normal expedited patching after confirming network restrictions.
Technical view
The sendFile handler opened files using a cleaned path while performing authorization checks against the raw request path. A trailing slash could therefore make authorization evaluate a different filename, bypassing protection for .goshs ACL files and blocked paths. The issue is remotely reachable, requires no privileges or user interaction, and is fixed in 2.1.5.
Likely exposure
Exposure is likely where goshs earlier than 2.1.5 serves content to untrusted networks and relies on .goshs ACL files or block lists. Internet-facing and shared development instances deserve prompt review. The supplied sources do not establish how widely vulnerable deployments exist.
Exploitation context
The CVSS 3.1 score is 5.3: network-accessible, low complexity, unauthenticated, and confidentiality-only impact. The supplied record is not in KEV and provides no evidence of active exploitation. Practical impact depends on whether protected files or paths contain sensitive information.
Researcher notes
The flaw reflects an authorization canonicalization mismatch, categorized as CWE-41 and CWE-863. Validation should compare the path representation used for file resolution with the representation used for access decisions. The supplied evidence supports ACL and block-list bypass; it does not establish broader arbitrary-file access or integrity impact.
Mitigation direction
- Upgrade goshs to version 2.1.5 or later.
- Restrict untrusted network access until affected instances are upgraded.
- Review served directories for sensitive ACL files and blocked content.
- Follow the vendor advisory for any additional deployment-specific guidance.
Validation and detection
- Inventory all goshs deployments and confirm their running versions.
- Verify every exposed instance runs version 2.1.5 or later.
- Identify instances relying on .goshs ACL files or block lists.
- Review access logs for unusual requests involving protected paths and trailing slashes.
- Confirm sensitive content is no longer reachable through unauthorized requests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-41: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-66064 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4GitHub_MVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/goshs-labs/goshs/pull/222CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54faCVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resolution of Path Equivalence
Improper Resolution of Path Equivalence represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.