External risk intelligence

codeskyblue gohttpserver Zip Slip Arbitrary File Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-38600

The vulnerability exists in an HTTP server application designed for file serving and uploads. As a web-based file management tool, such software is commonly deployed as an internet-facing or externally accessible service to facilitate file transfers, making its endpoints, including upload functions, frequently reachable from the public internet.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an open-source HTTP server software, specifically in its file upload functionality. This issue allows for the arbitrary writing of files, meaning an attacker could potentially place any file anywhere on the server. This could have significant implications for data integrity and system security if the affected software is in use.

File uploads can be manipulated to overwrite server files.
This could impact systems handling file transfers.
Confirm relevance and potential exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted Zip archive to the server's upload endpoint. If the server processes this archive without proper validation, it could allow the attacker to write arbitrary files to the server's file system, potentially overwriting critical system files or injecting malicious code.

Entry condition: Attacker can reach the upload endpoint.
Trigger point: Uploading a malicious Zip archive.
Resulting risk: Arbitrary file write, system compromise.

Live Threat

Current exploitation, exposure, and threat context

A Zip Slip vulnerability in the `/upload` endpoint could allow an unauthenticated attacker to overwrite arbitrary files on the server by uploading a specially crafted ZIP archive. This could impact system integrity and availability.

System files and configurations at risk.
Arbitrary file write via crafted ZIP.
Potential for system compromise or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing externally facing web applications and file transfer services should address this vulnerability. The first practical step is to determine the scope of affected systems, confirm their accessibility and business criticality, and identify the system owners. A risk-based remediation plan can then be developed, considering factors like vendor coordination and maintenance windows.

Identify affected systems and owners.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is gohttpserver?

gohttpserver is an open-source HTTP server application designed specifically for file serving and sharing. Users typically deploy it to facilitate easy file transfers and manage document hosting over a network, making its upload functions a core feature for interacting with the file system.

What is the Zip Slip vulnerability in CVE-2026-38600?

This is a Path Traversal weakness, classified as CWE-22. It happens when software fails to properly sanitize filenames within an archive. In this case, an attacker can use 'zip slip' techniques—names like ../../file.txt—to force the server to write files outside of the intended target directory, potentially overwriting critical system files.

How does an attacker trigger this vulnerability?

The attack requires access to the /upload endpoint. The trigger is uploading a specially crafted ZIP archive designed to escape the target directory. If the software does not validate the paths inside the archive during extraction, the write occurs. Simply visiting the site or downloading files does not trigger the bug; it specifically requires the server to process a malicious file upload.

Do I need to worry if my gohttpserver instance is internal?

According to Halo Surface Signal, this software is frequently deployed as an internet-facing service for file transfers, increasing the risk. While internet-facing instances are the primary concern, internal systems remain at risk if an unauthorized person within your network can reach the upload endpoint. You should evaluate access controls for all deployments.

How should I respond to CVE-2026-38600?

Start by identifying all instances of gohttpserver running in your environment and determining which are critical or reachable by untrusted users. Coordinate with system owners to understand the business role of these servers. Once you have a full inventory of affected systems, prioritize remediation based on how exposed those specific servers are to potential attackers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.