Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the gohttp file server due to improper path sanitization. The root cause is in the FileServer.requestURIToFilepath function, which constructs a file system path from a user-provided request URI without properly neutralizing directory traversal sequences (../). Specifically, the line fullpath = filepath.Join(fileServer.Webroot, relpath[1:]) combines the server's webroot with the un-sanitized path from the request. The FileServer.handler function calls this vulnerable function and then proceeds to open the file at the constructed path using os.Open. This allows an unauthenticated remote attacker to send a crafted request, like /?../../../../etc/passwd, to read arbitrary files on the server's file system, limited only by the permissions of the running gohttp process.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/itang/gohttp | go | <= 0.0.0-20170713062009-34ea516ae408 |
