Skip to content
OpenAdvisories

Package · Go

goshs.de/goshs/v2

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-50138

    goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

    goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is…

    patrickhener goshs goshs.de/goshs goshs.de/goshs/v2 Go
  • High 7.5
    CVE-2026-54719

    goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of f…

    goshs-labs goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • High 7.4
    GHSA-mxg3-432p-mr72

    goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request

    ### Summary The `--tunnel` / `-t` flag opens an outbound SSH connection to `localhost.run:22` with `HostKeyCallback: ssh.InsecureIgnoreHostKey()`. The Go documentation for that function states verbatim: *"It should not be used for production code."* With the …

    goshs.de/goshs goshs.de/goshs/v2 Go