CVE-2026-38600: Path Traversal
Published Nov 3, 2026
·Updated
A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.
Event History
Nov 3, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected server's /upload endpoint and the ability to upload a crafted ZIP archive. No privileges or user interaction are required.
2
What is the impact of a successful exploit?
A crafted archive can cause arbitrary files to be written outside the intended extraction directory. This can result in compromise of confidentiality, integrity, and availability depending on the files the server process can write.
3
Which versions are affected?
The issue affects codeskyblue gohttpserver through version 1.3.0. The provided information does not identify a fixed version.