GHSA-wg2q-39h6-66x9 goshs has a Path Traversal issue

• Go goshs.de/goshs/v2: < 2.1.5-0.20260727065949-f3ef599e4091 → fixed in 2.1.5-0.20260727065949-f3ef599e4091 • Go github.com/patrickhener/goshs/v2: < 2.1.5-0.20260727065949-f3ef599e4091 → fixed in 2.1.5-0.20260727065949-f3ef599e4091 • Go goshs.de/goshs: <= 1.1.4 (no fix yet) • Go github.com/patrickhener/goshs: <= 1.1.4 (no fix yet)

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding (Medium): upload filename escapes the served tree (residual of CVE-2026-35393) The multipart filename fix (updown.go lines 135-136) splits on the path separator but never rejects "..". Uploading with filename=".." results in os.Create against the parent of the upload folder with a trailing marker character, outside the served tree, and the subsequent failed rename leaves that file behind. Verified: a file containing ESCAPED_WRITE_PROOF was written outside the webroot, unauthenticated, with the default configuration. Not claimed: a Windows-specific variant (Go's Part.FileName() already applies filepath.Base). Suggested fixes 1. Reject any upload filename that is "..", is empty after sanitisation, or resolves outside the upload folder; validate the final resolved destination rather than only transforming the input. Tooling AI assistance was used while investigating. The finding was reproduced against a running server on loopback.