Skip to content
OpenAdvisories

Package · Go

github.com/patrickhener/goshs/v2

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-54719

    goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of f…

    goshs-labs goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • High 7.7
    CVE-2026-40885

    goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

    goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged be…

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • High 8.7
    CVE-2026-40876

    SFTP root escape via prefix-based path validation in goshs

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks …

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go