CVE-2026-38600

Summary

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files by embedding directory traversal sequences (e.g., ../../) inside filenames within a malicious ZIP archive, bypassing intended upload restrictions.

Exploitability

Exploitation is straightforward for remote attackers with network access to the /upload endpoint, requiring only the ability to craft and submit a ZIP file containing path-traversing entries.

Blast radius

Successful exploitation could lead to full system compromise via writing web shells or overwriting critical binaries, enabling remote code execution, data exfiltration, or service disruption.

Detection

Defenders should monitor server logs for unusual file creation paths (e.g., entries with '..' in filenames during ZIP extraction) and inspect uploaded archive contents for traversal sequences; however, no specific log field or network signature is reliably observable per the published description.

Prioritized remediation

Upgrade to gohttpserver v1.3.1 or later, which includes a fix for the Zip Slip vulnerability in the /upload endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.