Threats affecting pkg:golang/github.com/codeskyblue/gohttpserver

A vulnerability in codeskyblue gohttpserver through version 1.3.0 involves a hardcoded session secret key. This flaw allows attackers to impersonate any user by forging session cookies, bypassing OpenID Connect authentication and gaining access to all controls.

A Zip Slip vulnerability exists in the /upload endpoint of codeskyblue gohttpserver versions through 1.3.0. This flaw allows attackers to write arbitrary files on the server by uploading a specially crafted Zip archive.