Skip to content
OpenAdvisories

Package · Go

github.com/patrickhener/goshs

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-64863

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files…

    goshs-labs goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • Critical 9.8
    CVE-2026-40884

    goshs: Empty-username SFTP password authentication bypass in goshs

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that confi…

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • Critical 9.3
    CVE-2026-40189

    goshs has a file-based ACL authorization bypass in goshs state-changing routes

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. …

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.8
    CVE-2026-35471

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.8
    CVE-2026-35393

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.8
    CVE-2026-35392

    goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.

    patrickhener goshs github.com/patrickhener/goshs Go
  • Critical 9.4
    CVE-2025-46816 Public exploit

    goshs route not protected, allows command execution

    goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c…

    patrickhener goshs github.com/patrickhener/goshs Go