{"id":"CVE-2026-38600","kind":"vulnerability","aliases":["CVE-2026-38600"],"related":[],"title":"gohttpserver: crafted zip upload writes arbitrary files to disk","description":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","summary":"The upload handler in gohttpserver up to v1.3.0 unzips uploaded archives (unzip=true) without checking entry paths, so a crafted zip can write files outside the target directory. The project is marked not maintained. A fix PR (#233) is open and unmerged.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gohttpserver","fixed":[],"affected":"<= 1.3.0","ecosystem":"go"}],"ecosystems":[],"tags":["file-upload","go","gohttpserver","other","self-hosted","zip-slip"],"not_affected_if":["auth-required","newer-version","upload-disabled"],"how_to_check":"Run 'gohttpserver --version' or check the image/binary tag; every release up to v1.3.0 is affected. Look at the start command or service file for --upload; without it the upload endpoint is off. Also check whether auth is on (--auth-type http/openid/oauth2-proxy) and whether the port is reachable from untrusted networks. Look for files outside the served root that were written recently.","fix":"No fixed release known. The README says the project is not maintained. Upstream PR #233 adds a path check to unzipFile but was still open and unmerged when last seen. Until a release exists, do not run with --upload, or block unzip=true uploads at a reverse proxy.","status":"open","published_at":"2026-11-03T17:18:13+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:24:47+00:00","updated_at":"2026-11-03T17:26:24+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-03T17:24:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"gohttpserver: crafted zip upload writes arbitrary files to disk","impact":"high","summary":"The /upload endpoint of codeskyblue gohttpserver through v1.3.0 extracts zip archives without checking entry paths, a Zip Slip flaw. An attacker who uploads a crafted archive can write files to arbitrary locations on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["gohttpserver","self-hosted","go"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker writes arbitrary files, possibly achieving code execution on the server","analyst_note":"Confirm the fixed version, default upload configuration and whether authentication is required, using the NVD entry and the upstream gohttpserver repository.","how_to_check":"- Check whether the running gohttpserver version is `1.3.0` or earlier\n- Confirm whether the `/upload` endpoint is reachable from untrusted networks\n- unknown for any further checks, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["upload-disabled","newer-version"],"who_is_affected":"Teams running codeskyblue gohttpserver version 1.3.0 or earlier that expose the /upload endpoint. The sources do not say whether upload is enabled by default or what authentication the endpoint requires.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4098,"output_tokens":536,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version, default upload configuration and whether authentication is required, using the NVD entry and the upstream gohttpserver repository.","search":"'-2026':11A,14A '-38600':12A,15A '/upload':77C '233':66B 'allow':84C 'arbitrari':6A,88C 'archiv':39B,95C 'attack':85C 'check':43B 'codeskyblu':80C 'craft':2A,48B,93C 'cve':10A,13A 'directori':56B 'disk':9A 'endpoint':78C 'entri':44B 'file':7A,18B,52B,89C 'file-upload':17B 'fix':64B 'go':20B 'gohttpserv':1A,21B,33B,81C 'gohttpserver':16A 'handler':31B 'host':25B 'maintain':62B 'mark':60B 'open':68B 'outsid':53B 'path':45B 'pr':65B 'project':58B 'self':24B 'self-host':23B 'slip':28B,73C 'target':55B 'true':41B 'unmerg':70B 'unzip':37B,40B 'upload':4A,19B,30B,38B,91C 'v1.3.0':36B,83C 'via':90C 'vulner':74C 'without':42B 'write':5A,51B,87C 'zip':3A,27B,49B,72C,94C 'zip-slip':26B","nicknames":[],"mitigations":[],"who_affected":"Teams running codeskyblue gohttpserver v1.3.0 or earlier with uploads turned on (the --upload flag, or an upload rule in .ghs.yml). The unzip step runs when an upload is sent with unzip=true, and the entry names are not checked. If you do not enable upload, you can skip this. The README says upload is by token or session, and the project is unmaintained with no fixed release.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gohttpserver"],"ptokens":["gohttpserver"],"labels":["fileupload","go","gohttpserver","high","other","selfhosted","zipslip"],"first_public_at":"2026-11-03T17:18:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-38600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38600","severity":null,"published_at":"2026-11-03T17:18:13+00:00","modified_at":"2026-11-03T17:18:13+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-38600:1514","url":null,"severity":null,"published_at":"2026-11-03T17:26:24+00:00","modified_at":"2026-11-03T17:26:24+00:00","first_seen_at":"2026-11-03T17:26:24+00:00","fetched_at":"2026-11-03T17:26:24+00:00","note":"Source: NVD plus the upstream README and PR #233 (found via search; the PR page itself would not fetch, so its content is from the search snippet). No fix released; project marked not maintained. Researcher Den-Sec lists the CVE as Zip Slip to RCE, 9.1, in their own profile, not the vendor. Nothing is verified because there is no maintainer advisory. Unclear: whether upload without auth is possible in a default config. Upload needs --upload; auth is optional."}],"documents":[{"id":59274,"url":"https://github.com/codeskyblue/gohttpserver","title":"codeskyblue/gohttpserver README (not maintained; --upload flag, unzip=true)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":59272,"url":"https://github.com/codeskyblue/gohttpserver/pull/233","title":"PR #233: Zip Slip protection in unzipFile (open, unmerged)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":59276,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38600","title":"NVD CVE-2026-38600","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}