{"id":"CVE-2026-38600","published":"2026-11-03T17:18:13.070","lastModified":"2026-11-03T22:19:47.327","description":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","tags":[]},{"url":"https://github.com/codeskyblue/gohttpserver","tags":[]},{"url":"https://github.com/codeskyblue/gohttpserver/issues/232","tags":[]},{"url":"https://security.snyk.io/research/zip-slip-vulnerability","tags":[]},{"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","tags":[]},{"url":"https://github.com/codeskyblue/gohttpserver","tags":[]},{"url":"https://github.com/codeskyblue/gohttpserver/issues/232","tags":[]},{"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files by embedding directory traversal sequences (e.g., ../../) inside filenames within a malicious ZIP archive, bypassing intended upload restrictions.","exploitability":"Exploitation is straightforward for remote attackers with network access to the /upload endpoint, requiring only the ability to craft and submit a ZIP file containing path-traversing entries.","blast_radius":"Successful exploitation could lead to full system compromise via writing web shells or overwriting critical binaries, enabling remote code execution, data exfiltration, or service disruption.","remediation":"Upgrade to gohttpserver v1.3.1 or later, which includes a fix for the Zip Slip vulnerability in the /upload endpoint.","detection":"Defenders should monitor server logs for unusual file creation paths (e.g., entries with '..' in filenames during ZIP extraction) and inspect uploaded archive contents for traversal sequences; however, no specific log field or network signature is reliably observable per the published description.","tags":["zip-slip","arbitrary-file-write","web","upload"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:47:26.094Z"}}