A directory traversal vulnerability in the gohttp library permits unauthenticated attackers to read arbitrary files from the server's filesystem.

The library fails to properly sanitize requests, allowing for directory traversal. The vulnerability is unauthenticated (PR:N) and accessible over the network (AV:N), making it highly reachable for remote attackers.

This vulnerability could result in the unauthorized disclosure of sensitive configuration files, source code, or internal system data. The CVSS score of 7.3 reflects the significant risk posed by unauthenticated access to the underlying filesystem, which could serve as a precursor to further system compromise.

Immediate Action: Check the project repository for updates or patches addressing the directory traversal flaw. If no patch is available, consider switching to a more secure, maintained HTTP library.

Proactive Monitoring: Review web server access logs for requests containing path traversal sequences (e.g., "../") and monitor for unusual file read requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal patterns and normalize URI paths before they reach the application.

Public Exploit Available: false

Given the existence of a proof-of-concept, this vulnerability should be treated with high urgency. Developers using the gohttp library should prioritize verifying their version against the latest commits or migrating to a secure alternative to eliminate this exposure.