CVE-2026-66063 is a path traversal vulnerability in goshs, a Go-based single-binary file server explicitly marketed for red team operations. The bug is a textbook partial sanitization failure: the developer implemented path splitting on forward slashes but never validated for ".." sequences. This isn't a case of forgotten input validation — the split operation was deliberate defensive code that didn't go far enough.
The immediate technical fix is straightforward: reject path components containing ".." during upload processing, or canonicalize and validate the full resolved path before file operations. But the operational context changes the severity calculation significantly.
Deploy goshs on a machine with elevated network access during an engagement, and a path traversal becomes something more than arbitrary file write on a dev utility. The binary likely runs on the most privileged node in the assessment environment — the same machine moving payloads across the engagement boundary. That's a different blast radius than the same CVSS score on an internal DevOps script, even with identical technical impact.
The category matters for another reason: single-binary distribution correlates with users who deploy and use, not audit. Red teamers specifically operate under time pressure to get tools working, not to review them. This creates a trust asymmetry — the same professionals who would catch a path traversal instantly in client code deploy unauthenticated upload handlers from GitHub releases without equivalent scrutiny. The supply chain posture would fail any enterprise audit, yet it describes standard practice in offensive security tooling.
If you're running goshs in any operational context: assume the upload endpoint can write outside its intended directory. Isolate the binary from any infrastructure you'd rather not have an attacker control. The CVSS 6.5 rating doesn't account for the deployment context — treat the risk as higher than the score suggests, because the machine it's running on is likely more valuable to an attacker than the score reflects.