Critical 9.8 CVSS Flaws in goshs Exposed

Security researchers disclosed three critical path-traversal vulnerabilities in goshs that allow unauthenticated attackers to write or delete files anywhere on a host’s filesystem by abusing unsanitized URL-derived paths; two issues are rated CVSS 9.8 and a fixed release v2.0.0-beta.3 is available. Recommended actions include immediate upgrade, using Basic Auth as defense-in-depth, and running the service with non-root privileges.