CVE-2026-66063 | goshs-labs goshs up to 2.1.4 Multipart Upload httpserver/updown.go part.FileName path traversal

A vulnerability classified as critical has been found in goshs-labs goshs up to 2.1.4. Affected by this issue is the function part.FileName of the file httpserver/updown.go of the component Multipart Upload Handler. Performing a manipulation results in path traversal.

This vulnerability was named CVE-2026-66063. The attack may be initiated remotely. There is no available exploit.

It is recommended to upgrade the affected component.