Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/patrickhener/goshs

16 known vulnerabilities (7 critical, 5 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
v1.1.4 (Mar 13, 2026): affected by 15 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
16 · 7 critical, 5 high, 4 medium
Releases
47 since v0.0.1 (Oct 2, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 16 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • CVE-2026-66064Medium 5.3

    goshs has ACL Bypass & Path Traversal

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-66063Medium 6.5

    goshs has a Path Traversal issue

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-64863Critical 9.1

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-42091Medium 6.5

    goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

    Affected: all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-40884Critical 9.8

    goshs: Empty-username SFTP password authentication bypass in goshs

    Affected: all versions; through 1.1.4.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-40883Medium 6.1

    goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

    Affected: all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • SFTP root escape via prefix-based path validation in goshs

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-40189Critical 9.3

    goshs has a file-based ACL authorization bypass in goshs state-changing routes

    Affected: through 1.1.4; all versions.

    No fix released. The latest release, v1.1.4, is still affected.

  • goshs is Missing Write Protection for Parametric Data Values

    Affected: from 1.0.7; from 1.0.7, through 1.1.4.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2026-35471Critical 9.8

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs

    Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9.

    No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected.

  • CVE-2026-35393Critical 9.8

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

    Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9.

    No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected.

  • CVE-2026-35392Critical 9.8

    goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

    Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9.

    No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected.

  • goshs has Auth Bypass via Share Token

    Affected: from 1.1.0.

    No fix released. The latest release, v1.1.4, is still affected.

  • CVE-2025-46816Critical 9.4

    goshs route not protected, allows command execution

    Affected: from 0.3.4, fixed in 1.0.5.

    Fixed in v1.0.5 (released May 6, 2025, the day of disclosure).

    The latest release, v1.1.4, is not affected.