goshs has Auth Bypass via Share Token
Priority HIGH 70CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.
Summary
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00399 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed goshs (patrickhener): 2.0.0-beta.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| patrickhener | goshs | 1.1.0 to before 2.0.0-beta.2 | 2.0.0-beta.2 | Patch available | CNA |
| — | github.com/patrickhener/goshs (Go) | 1.1.0 and later | — | No fix listed | GHSA-jgfx-74g2-9r6g |
- goshs Vendorpatrickhener Affected 1.1.0 to before 2.0.0-beta.2 Fixed in 2.0.0-beta.2 Patch available CNA
- github.com/patrickhener/goshs (Go) Vendor— Affected 1.1.0 and later Fixed in — No fix listed GHSA-jgfx-74g2-9r6g
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* | 1.1.0 to before 2.0.0 | Vulnerable | patrickhener |
| cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* | 2.0.0 beta1 | Vulnerable | patrickhener |
- cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* Versions 1.1.0 to before 2.0.0 Vulnerable ·patrickhener
- cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* Versions 2.0.0 beta1 Vulnerable ·patrickhener
Remediation
- Fix · CNA goshs (patrickhener) Fixed in 2.0.0-beta.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34581
- 2026-10-03 Alias added: GHSA-jgfx-74g2-9r6g
References
More patrickhener Goshs vulnerabilities
- TI-2026-29540 goshs: Empty-username SFTP password authentication bypass in goshs CVSS 3.1CRITICAL 9.8
- TI-2026-27601 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVSS 3.0CRITICAL 9.8
- TI-2026-27529 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVSS 3.0CRITICAL 9.8
- TI-2026-27528 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVSS 3.0CRITICAL 9.8
- TI-2026-29003 goshs has a file-based ACL authorization bypass in goshs state-changing routes CVSS 4.0CRITICAL 9.3
- TI-2026-29532 SFTP root escape via prefix-based path validation in goshs CVSS 4.0HIGH 8.7
Sources
- CVE-2026-34581 · CVE Program
- CVE-2026-34581 · NVD
- FIRST EPSS
- GHSA-jgfx-74g2-9r6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences