Vulnerabilities

TI-2026-36910 CVE-2026-50139 · GHSA-j48m-h7xq-2xpj

goshs: Share-link ?token=… redemption races past download limit

MEDIUM 60

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00256 Published 2026-08-18 Fixed in 2.1.0 CWE-362

TI-2026-36909 CVE-2026-50138 · GHSA-3whc-qvhv-xqjp

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

HIGH 70

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0038 Published 2026-08-18 Fixed in 2.1.0 CWE-284

TI-2026-30459 CVE-2026-42091 · GHSA-rhf7-wvw3-vjvm

goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

MEDIUM 62

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00165 Published 2026-05-04 Fixed in 2.0.2 CWE-352

TI-2026-29559 CVE-2026-40903

Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence

MEDIUM 47

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00245 Published 2026-04-21 Fixed in 2.0.0-beta.6 CWE-829

TI-2026-29541 CVE-2026-40885 · GHSA-7h3j-592v-jcrp

goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

HIGH 69

goshs is a SimpleHTTPServer written in Go.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00311 Published 2026-04-21 Fixed in 2.0.0-beta.6 CWE-200

TI-2026-29540 CVE-2026-40884 · GHSA-c29w-qq4m-2gcv

goshs: Empty-username SFTP password authentication bypass in goshs

HIGH 82

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00478 Published 2026-04-21 Fixed in 2.0.0-beta.6, 2.0.0 CWE-306

TI-2026-29539 CVE-2026-40883 · GHSA-jrq5-hg6x-j6g3

goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

MEDIUM 60

goshs is a SimpleHTTPServer written in Go.

CVSS 4.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00143 Published 2026-04-21 Fixed in 2.0.0-beta.6 CWE-352

TI-2026-29532 CVE-2026-40876 · GHSA-5h6h-7rc9-3824

SFTP root escape via prefix-based path validation in goshs

HIGH 73

goshs is a SimpleHTTPServer written in Go.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00439 Published 2026-04-21 Fixed in 2.0.0-beta.6, 2.0.0 CWE-22

TI-2026-29003 CVE-2026-40189 · GHSA-wvhv-qcqf-f3cx

goshs has a file-based ACL authorization bypass in goshs state-changing routes

HIGH 81

goshs is a SimpleHTTPServer written in Go.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00668 Published 2026-04-10 Fixed in 2.0.0-beta.4 CWE-862

TI-2026-29002 CVE-2026-40188 · GHSA-2943-crp8-38xx

goshs is Missing Write Protection for Parametric Data Values

HIGH 67

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-10 Fixed in 2.0.0-beta.4 CWE-1314

TI-2026-27601 CVE-2026-35471 · GHSA-6qcc-6q27-whp8

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs

HIGH 82

goshs is a SimpleHTTPServer written in Go.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0065 Published 2026-04-06 Fixed in 2.0.0-beta.3, 1.1.5-0.20260401172448-237f3af891a9 CWE-22

TI-2026-27529 CVE-2026-35393 · GHSA-jg56-wf8x-qrv5

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

HIGH 82

goshs is a SimpleHTTPServer written in Go.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0065 Published 2026-04-06 Fixed in 2.0.0-beta.3, 1.1.5-0.20260401172448-237f3af891a9 CWE-22

TI-2026-27528 CVE-2026-35392 · GHSA-g8mv-vp7j-qp64

goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

HIGH 82

goshs is a SimpleHTTPServer written in Go.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0065 Published 2026-04-06 Fixed in 2.0.0-beta.3, 1.1.5-0.20260401172448-237f3af891a9 CWE-22

TI-2026-26829 CVE-2026-34581 · GHSA-jgfx-74g2-9r6g

goshs has Auth Bypass via Share Token

HIGH 70

goshs is a SimpleHTTPServer written in Go.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00399 Published 2026-04-02 Fixed in 2.0.0-beta.2 CWE-288

TI-2025-29449 CVE-2025-46816 · GHSA-rwj2-w85g-5cmm

goshs route not protected, allows command execution

HIGH 82

goshs is a SimpleHTTPServer written in Go.

CVSS 3.0CRITICAL 9.4 Network No auth No interaction EPSS 0.0075 Published 2025-05-06 Fixed in 1.0.5 CWE-284

Vulnerabilities

Filters