Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/patrickhener/goshs/v2

10 known vulnerabilities (3 critical, 3 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
v2.0.0 (Apr 14, 2026): affected by 5 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
10 · 3 critical, 3 high, 4 medium
Releases
1 since v2.0.0 (Apr 14, 2026)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • CVE-2026-66064Medium 5.3

    goshs has ACL Bypass & Path Traversal

    Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091.

    No fix released. The advisory names 2.1.5-0.20260727065949-f3ef599e4091 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected.

  • CVE-2026-66063Medium 6.5

    goshs has a Path Traversal issue

    Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091.

    No fix released. The advisory names 2.1.5-0.20260727065949-f3ef599e4091 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected.

  • CVE-2026-64863Critical 9.1

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    Affected: fixed in 2.1.4.

    No fix released. The advisory names 2.1.4 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected.

  • goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    Affected: fixed in 2.1.1.

    No fix released. The advisory names 2.1.1 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected.

  • CVE-2026-62325Critical 9.1

    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

    Affected: from 2.1.3, fixed in 2.1.4.

    No fix released. The advisory names 2.1.4 as the fix, which the registry doesn't have yet.

  • CVE-2026-42091Medium 6.5

    goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

    Affected: fixed in 2.0.2.

    No fix released. The advisory names 2.0.2 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected.

  • goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

    Affected: from 2.0.0-beta.4, fixed in 2.0.0-beta.6.

    Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure, the advisory names 2.0.0-beta.6, which was never published).

    The latest release, v2.0.0, is not affected.

  • CVE-2026-40884Critical 9.8

    goshs: Empty-username SFTP password authentication bypass in goshs

    Affected: fixed in 2.0.0.

    Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure).

    The latest release, v2.0.0, is not affected.

  • CVE-2026-40883Medium 6.1

    goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

    Affected: from 2.0.0-beta.4, fixed in 2.0.0-beta.6.

    Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure, the advisory names 2.0.0-beta.6, which was never published).

    The latest release, v2.0.0, is not affected.

  • SFTP root escape via prefix-based path validation in goshs

    Affected: fixed in 2.0.0.

    Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure).

    The latest release, v2.0.0, is not affected.