# github.com/patrickhener/goshs (Go) vulnerabilities 16 known vulnerabilities (7 critical, 5 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.1.4 (Mar 13, 2026): affected by 15 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 47 since v0.0.1 (Oct 2, 2020) - Registry: https://pkg.go.dev/github.com/patrickhener/goshs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-66064: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-66063: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-64863: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-54719: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-42091: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40885: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40884: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40883: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40876: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40189: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-40188: v1.0.7 to v1.1.4 (through the newest release) - CVE-2026-35471: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-35393: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-35392: v0.0.1 to v1.1.4 (through the newest release) - CVE-2026-34581: v1.1.0 to v1.1.4 (through the newest release) - CVE-2025-46816: v0.3.4 to v1.0.4 (v1.0.5 is outside it) ## Advisories (16) ### [CVE-2026-66064](https://cve.now/CVE-2026-66064): goshs has ACL Bypass & Path Traversal - Severity: Medium 5.3 - Published: Jul 28, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-66063](https://cve.now/CVE-2026-66063): goshs has a Path Traversal issue - Severity: Medium 6.5 - Published: Jul 28, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-64863](https://cve.now/CVE-2026-64863): goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite - Severity: Critical 9.1 - Published: Jul 28, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-54719](https://cve.now/CVE-2026-54719): goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-42091](https://cve.now/CVE-2026-42091): goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS - Severity: Medium 6.5 - Published: May 4, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40885](https://cve.now/CVE-2026-40885): goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access - Severity: High 7.7 - Published: Apr 21, 2026 - Affected: all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40884](https://cve.now/CVE-2026-40884): goshs: Empty-username SFTP password authentication bypass in goshs - Severity: Critical 9.8 - Published: Apr 21, 2026 - Affected: all versions; through 1.1.4. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40883](https://cve.now/CVE-2026-40883): goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation - Severity: Medium 6.1 - Published: Apr 21, 2026 - Affected: all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40876](https://cve.now/CVE-2026-40876): SFTP root escape via prefix-based path validation in goshs - Severity: High 8.7 - Published: Apr 21, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40189](https://cve.now/CVE-2026-40189): goshs has a file-based ACL authorization bypass in goshs state-changing routes - Severity: Critical 9.3 - Published: Apr 10, 2026 - Affected: through 1.1.4; all versions. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-40188](https://cve.now/CVE-2026-40188): goshs is Missing Write Protection for Parametric Data Values - Severity: High 7.7 - Published: Apr 10, 2026 - Affected: from 1.0.7; from 1.0.7, through 1.1.4. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2026-35471](https://cve.now/CVE-2026-35471): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs - Severity: Critical 9.8 - Published: Apr 6, 2026 - Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9. - No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected. ### [CVE-2026-35393](https://cve.now/CVE-2026-35393): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload - Severity: Critical 9.8 - Published: Apr 6, 2026 - Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9. - No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected. ### [CVE-2026-35392](https://cve.now/CVE-2026-35392): goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload - Severity: Critical 9.8 - Published: Apr 6, 2026 - Affected: fixed in 1.1.5-0.20260401172448-237f3af891a9. - No fix released. The advisory names 1.1.5-0.20260401172448-237f3af891a9 as the fix, which the registry doesn't have yet. The latest release, v1.1.4, is still affected. ### [CVE-2026-34581](https://cve.now/CVE-2026-34581): goshs has Auth Bypass via Share Token - Severity: High 8.1 - Published: Apr 2, 2026 - Affected: from 1.1.0. - No fix released. The latest release, v1.1.4, is still affected. ### [CVE-2025-46816](https://cve.now/CVE-2025-46816): goshs route not protected, allows command execution - Severity: Critical 9.4 - Published: May 6, 2025 - Affected: from 0.3.4, fixed in 1.0.5. - Fixed in v1.0.5 (released May 6, 2025, the day of disclosure). - The latest release, v1.1.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/patrickhener/goshs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.