TI-2026-29540 CVE-2026-40884 · GHSA-c29w-qq4m-2gcv
goshs: Empty-username SFTP password authentication bypass in goshs
Priority HIGH 82
goshs is a SimpleHTTPServer written in Go.
patrickhener
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
patrickhener records in CISA KEVNo patrickhener vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records
TI-2026-27601 CVE-2026-35471 · GHSA-6qcc-6q27-whp8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
Priority HIGH 82
goshs is a SimpleHTTPServer written in Go.
TI-2026-27529 CVE-2026-35393 · GHSA-jg56-wf8x-qrv5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
Priority HIGH 82
goshs is a SimpleHTTPServer written in Go.
TI-2026-27528 CVE-2026-35392 · GHSA-g8mv-vp7j-qp64
goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
Priority HIGH 82
goshs is a SimpleHTTPServer written in Go.
TI-2025-29449 CVE-2025-46816 · GHSA-rwj2-w85g-5cmm
goshs route not protected, allows command execution
Priority HIGH 82
goshs is a SimpleHTTPServer written in Go.
TI-2026-29003 CVE-2026-40189 · GHSA-wvhv-qcqf-f3cx
goshs has a file-based ACL authorization bypass in goshs state-changing routes
Priority HIGH 81
goshs is a SimpleHTTPServer written in Go.
TI-2026-29532 CVE-2026-40876 · GHSA-5h6h-7rc9-3824
SFTP root escape via prefix-based path validation in goshs
Priority HIGH 73
goshs is a SimpleHTTPServer written in Go.
TI-2026-36909 CVE-2026-50138 · GHSA-3whc-qvhv-xqjp
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Priority HIGH 70
goshs is a SimpleHTTPServer written in Go.
TI-2026-26829 CVE-2026-34581 · GHSA-jgfx-74g2-9r6g
goshs has Auth Bypass via Share Token
Priority HIGH 70
goshs is a SimpleHTTPServer written in Go.
TI-2026-29541 CVE-2026-40885 · GHSA-7h3j-592v-jcrp
goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
Priority HIGH 69
goshs is a SimpleHTTPServer written in Go.
TI-2026-29002 CVE-2026-40188 · GHSA-2943-crp8-38xx
goshs is Missing Write Protection for Parametric Data Values
Priority HIGH 67
goshs is a SimpleHTTPServer written in Go.
TI-2026-30459 CVE-2026-42091 · GHSA-rhf7-wvw3-vjvm
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
Priority MEDIUM 62
goshs is a SimpleHTTPServer written in Go.
TI-2026-36910 CVE-2026-50139 · GHSA-j48m-h7xq-2xpj
goshs: Share-link ?token=… redemption races past download limit
Priority MEDIUM 60
goshs is a SimpleHTTPServer written in Go.
TI-2026-29539 CVE-2026-40883 · GHSA-jrq5-hg6x-j6g3
goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Priority MEDIUM 60
goshs is a SimpleHTTPServer written in Go.
TI-2026-29559 CVE-2026-40903
Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence
Priority MEDIUM 47
goshs is a SimpleHTTPServer written in Go.