Live › vulnerability › CVE-2026-38600
The upload handler in gohttpserver up to v1.3.0 unzips uploaded archives (unzip=true) without checking entry paths, so a crafted zip can write files outside the target directory. The project is marked not maintained. A fix PR (#233) is open and unmerged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams running codeskyblue gohttpserver v1.3.0 or earlier with uploads turned on (the --upload flag, or an upload rule in .ghs.yml). The unzip step runs when an upload is sent with unzip=true, and the entry names are not checked. If you do not enable upload, you can skip this. The README says upload is by token or session, and the project is unmaintained with no fixed release.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| gohttpserver | go | <= 1.3.0 | – |
gohttpserver --version or check the image/binary tag; every release up to v1.3.0 is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
This page as .md · .json · in your agent: get_signal("CVE-2026-38600")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.