CVE-2026-35471: 
NixOS vulnerability analysis and mitigation

CVE-2026-35471 is a path traversal vulnerability (CWE-22) in goshs (Go Simple HTTP Server) that allows unauthenticated remote attackers to delete arbitrary files and directories on the host system. The flaw resides in the deleteFile() function in httpserver/handler.go (lines 645–671), where a missing return statement after a path traversal guard renders the check ineffective. Affected versions include all goshs releases prior to v2.0.0-beta.3 (including v2.0.0-beta.1 and v2.0.0-beta.2, and all versions below 2.0.0). It was published on April 1, 2026, and carries a CVSS v3.0 base score of 9.8 (Critical) (GitHub Advisory, goshs Advisory).

The root cause is a missing return statement in the deleteFile() Go handler after writing a 500 error response when a .. sequence is detected in the decoded request path. Because execution falls through to os.RemoveAll(deletePath), the path traversal guard is effectively dead code. An attacker triggers the vulnerability by sending a crafted HTTP GET request to /?delete with a double-encoded path traversal payload (e.g., %252e%252e/ repeated to escape the webroot), which bypasses the .. string check performed on the URL-decoded path. No authentication, special flags, or prior access is required — the vulnerability is exploitable in the default goshs configuration. A public proof-of-concept bash script is included in the advisory (goshs Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to delete any file or directory accessible to the goshs process on the host system via os.RemoveAll(), regardless of whether the target is within the configured webroot. This results in high impacts to integrity and availability (arbitrary data destruction, service disruption, or deletion of critical system files), and potentially confidentiality if sensitive file paths can be inferred. In worst-case scenarios, deletion of configuration files, credentials, or system binaries could facilitate further compromise or denial of service (goshs Advisory).

A complete, functional proof-of-concept bash exploit script is publicly available in the GitHub Security Advisory, demonstrating arbitrary file deletion with no authentication required (goshs Advisory). The EPSS score is approximately 0.069% (0.056% per GitHub Advisory), placing it in the 18th percentile for near-term exploitation probability. As of the advisory publication, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (detection ID 5010376) (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible goshs instances (versions ≤ v2.0.0-beta.2) using tools like Shodan, Censys, or network scanning. goshs typically runs on port 8000 by default.
2. Identify target file: Determine the absolute path of the file or directory to delete on the target system (e.g., /tmp/canary, a configuration file, or a critical binary).
3. Construct traversal payload: Double-encode .. as %252e%252e and repeat 16 times to build a traversal string sufficient to escape the webroot: %252e%252e/%252e%252e/... (16 levels).
4. URL-encode the target path: Strip the leading / from the target path and URL-encode any special characters using Python: python3 -c "import urllib.parse; print(urllib.parse.quote('tmp/canary', safe='/'))" .
5. Send the crafted request: Issue an HTTP GET request to http://<HOST>:<PORT>/<TRAVERSAL><ENCODED_TARGET>?delete using curl or the provided PoC script. Example: curl -s "http://10.1.2.2:8000/%252e%252e/%252e%252e/.../tmp/canary?delete".
6. Verify deletion: Confirm the file or directory has been removed on the target system. The server responds with an HTTP status code; a 200 or 500 response may both indicate the deletion was attempted and executed due to the missing return bug (goshs Advisory).

• Network: HTTP GET requests to the goshs server containing %252e%252e (double-encoded ..) sequences in the URL path, combined with the ?delete query parameter; unusual DELETE-equivalent activity from unexpected source IPs.
• Logs: goshs access logs showing requests matching the pattern GET /(%252e%252e/){n}<target_path>?delete with HTTP 200 or 500 response codes; repeated requests from the same source IP targeting different paths.
• File System: Unexpected disappearance of files or directories outside the goshs webroot; missing configuration files, credentials, or system binaries that the goshs process user had permission to delete.
• Process: os.RemoveAll activity by the goshs process on paths outside its configured webroot, observable via system call auditing (e.g., auditd on Linux monitoring unlinkat/rmdir syscalls from the goshs PID) (goshs Advisory).

Upgrade goshs to v2.0.0-beta.3 or later (or the patched commit 1.1.5-0.20260401172448-237f3af891a9 for the Go module), which adds the missing return statement after the path traversal error response in deleteFile(). As a workaround prior to patching, restrict network access to the goshs service to trusted hosts only using firewall rules, and avoid exposing goshs instances to untrusted networks. Additionally, run goshs with the minimum necessary OS permissions to limit the blast radius of any file deletion (goshs Advisory, GitHub Advisory).

The vulnerability was reported by researcher autobot23920 and published by the goshs maintainer (patrickhener) on April 1, 2026. Coverage appeared on The Hacker Wire with a dedicated write-up titled "goshs SimpleHTTPServer Path Traversal Leads to File Deletion" (The Hacker Wire). Social media discussion was noted on Mastodon (infosec.exchange) and Bluesky, and the vulnerability was picked up by multiple CVE aggregation and threat intelligence platforms shortly after disclosure (Feedly).