CVE-2026-35392: 
NixOS vulnerability analysis and mitigation

CVE-2026-35392 is a critical path traversal vulnerability (CWE-22) in goshs (Go Simple HTTP Server), a SimpleHTTPServer written in Go. The flaw exists in the PUT upload handler (httpserver/updown.go:20-69), which uses the raw request URL path without any sanitization to construct the file save path, enabling unauthenticated arbitrary file writes anywhere on the filesystem. All versions prior to v2.0.0-beta.3 (and prior to 1.1.5-0.20260401172448-237f3af891a9 for the Go module) are affected; the vulnerability is exploitable in the default configuration with no flags or authentication required. It was published on April 2, 2026, and carries a CVSS v3.0 base score of 9.8 (Critical) (GitHub Advisory, Github Advisory).

The root cause is improper path handling in the put() function within httpserver/updown.go (lines 20–69), classified as CWE-22 (Path Traversal). The handler reads req.URL.Path directly and uses pure string concatenation — with no call to filepath.Clean, no .. sequence check, and no webroot containment — to build the savepath variable before calling os.Create(savepath). Because UploadFolder defaults to Webroot (set in main.go:386-388), an attacker can supply URL-encoded traversal sequences (e.g., %2e%2e/) in the PUT request path to escape the intended directory and write to arbitrary filesystem locations. The server routes all PUT requests directly to put() via server.go:57-59, and no authentication is required in the default configuration (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to any location on the server's filesystem that the goshs process has write access to. This can lead to code execution (e.g., by overwriting cron jobs, SSH authorized keys, or web-accessible scripts), full system compromise, and potential lateral movement within the network. Confidentiality, integrity, and availability are all rated High, as an attacker could exfiltrate data by overwriting configuration files, corrupt system files to cause denial of service, or establish persistent backdoors (GitHub Advisory, Github Advisory).

A complete, runnable proof-of-concept bash script is publicly available in the GitHub Security Advisory, demonstrating arbitrary file write via HTTP PUT with URL-encoded path traversal sequences (%2e%2e/). The exploit requires no authentication, no special privileges, and works against the default goshs configuration, making it trivially weaponizable. The EPSS score is approximately 0.056% (18th percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. Qualys has added detection for this vulnerability (detection ID 5010380) (GitHub Advisory, Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible goshs instances (default port 8000) using tools like Shodan, Censys, or network scanning. Confirm the version is prior to v2.0.0-beta.3.
2. Prepare payload: Select or create a local file to upload (e.g., a malicious script, SSH public key, or cron job entry).
3. Construct traversal path: Build a URL path using 16 levels of URL-encoded .. sequences (%2e%2e/) to escape the webroot and reach the filesystem root, then append the absolute target path (e.g., /%2e%2e/%2e%2e/.../%2e%2e/etc/cron.d/backdoor).
4. Send PUT request: Use curl with --path-as-is to prevent client-side path resolution, sending the file as the request body:

   curl -s -o /dev/null -w "%{http_code}" \
     --path-as-is \
     -X PUT --data-binary "@./malicious_file" \
     "http://<host>:8000/%2e%2e/%2e%2e/.../%2e%2e/tmp/backdoor"

5. Achieve objective: Verify the file was written to the target path. Depending on the target location (e.g., SSH authorized_keys, cron job, or a web-accessible script), trigger code execution or establish persistence (GitHub Advisory).

• Network: HTTP PUT requests to the goshs server containing %2e%2e or .. sequences in the URL path; requests with --path-as-is-style paths that include repeated encoded dot-dot segments; unexpected outbound connections from the goshs host following PUT activity.
• Logs: goshs access logs showing PUT requests with URL-encoded traversal patterns (e.g., PUT /%2e%2e/%2e%2e/... or PUT /../../...); HTTP 200 responses to such requests indicating successful file writes.
• File System: Unexpected or newly created files in sensitive directories (e.g., /tmp/, /etc/cron.d/, ~/.ssh/authorized_keys, /var/www/) with timestamps correlating to PUT request activity; new or modified cron jobs, SSH keys, or scripts not associated with normal operations.
• Process: Unusual processes spawned by the goshs binary or its parent process following suspicious PUT activity (e.g., reverse shells, unexpected script execution) (GitHub Advisory).

Upgrade goshs to v2.0.0-beta.3 or later (Go module: 1.1.5-0.20260401172448-237f3af891a9 or later), which introduces proper path sanitization in the PUT upload handler. If immediate patching is not possible, restrict network access to the goshs instance to trusted IP ranges only using firewall rules, or disable PUT upload functionality if it is not required. The advisory also recommends ensuring that method returns are called after every error response to prevent logic bypass (GitHub Advisory, Github Advisory).

The vulnerability was reported by security researcher autobot23920 and published by the project maintainer patrickhener on April 2, 2026. Coverage appeared on The Hacker Wire and was tracked by multiple vulnerability databases including CIRCL, VulDB, and ENISA's EUVD. Social media discussion was noted on Bluesky and Mastodon/infosec.exchange, and the OpenSUSE security announce mailing list referenced the advisory in the context of broader security updates (The Hacker Wire, GitHub Advisory).