goshs Path Traversal Vulnerability in POST Multipart Upload

A path traversal vulnerability has been identified in goshs versions through 2.0.0-beta.2. The issue arises in the POST multipart upload handling, where the upload directory is not properly sanitized. This flaw allows for unauthenticated arbitrary file writes to any existing directory on the filesystem.

Impact

Exploitation of this vulnerability allows for unauthenticated users to write files arbitrarily to any directory on the filesystem, potentially overwriting existing files.

Reproduction

To reproduce this vulnerability, send a POST request to the '/<path>/upload' endpoint. The request must include a multipart file upload. The vulnerability can be exploited by including '../..' in the URL path to traverse out of the webroot and into the filesystem, taking advantage of the unsanitized upload directory handling.

Remediation

Users are advised to update to goshs version 2.0.0-beta.3 or later, where this vulnerability has been fixed.