Skip to content
OpenAdvisories

Package · Go

github.com/patrickhener/goshs/v2

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-64863

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files…

    goshs-labs goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • Critical 9.1
    CVE-2026-62325

    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

    goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP a…

    goshs-labs goshs github.com/patrickhener/goshs/v2 goshs.de/goshs/v2 Go
  • Critical 9.8
    CVE-2026-40884

    goshs: Empty-username SFTP password authentication bypass in goshs

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that confi…

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go