# github.com/patrickhener/goshs/v2 (Go) vulnerabilities 10 known vulnerabilities (3 critical, 3 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.0.0 (Apr 14, 2026): affected by 5 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 1 since v2.0.0 (Apr 14, 2026) - Registry: https://pkg.go.dev/github.com/patrickhener/goshs/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-66064: v2.0.0 (through the newest release) - CVE-2026-66063: v2.0.0 (through the newest release) - CVE-2026-64863: v2.0.0 (through the newest release) - CVE-2026-54719: v2.0.0 (through the newest release) - CVE-2026-62325: no published release is affected - CVE-2026-42091: v2.0.0 (through the newest release) - CVE-2026-40885: no published release is affected - CVE-2026-40884: no published release is affected - CVE-2026-40883: no published release is affected - CVE-2026-40876: no published release is affected ## Advisories (10) ### [CVE-2026-66064](https://cve.now/CVE-2026-66064): goshs has ACL Bypass & Path Traversal - Severity: Medium 5.3 - Published: Jul 28, 2026 - Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091. - No fix released. The advisory names 2.1.5-0.20260727065949-f3ef599e4091 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected. ### [CVE-2026-66063](https://cve.now/CVE-2026-66063): goshs has a Path Traversal issue - Severity: Medium 6.5 - Published: Jul 28, 2026 - Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091. - No fix released. The advisory names 2.1.5-0.20260727065949-f3ef599e4091 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected. ### [CVE-2026-64863](https://cve.now/CVE-2026-64863): goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite - Severity: Critical 9.1 - Published: Jul 28, 2026 - Affected: fixed in 2.1.4. - No fix released. The advisory names 2.1.4 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected. ### [CVE-2026-54719](https://cve.now/CVE-2026-54719): goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: fixed in 2.1.1. - No fix released. The advisory names 2.1.1 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected. ### [CVE-2026-62325](https://cve.now/CVE-2026-62325): goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) - Severity: Critical 9.1 - Published: Jul 28, 2026 - Affected: from 2.1.3, fixed in 2.1.4. - No fix released. The advisory names 2.1.4 as the fix, which the registry doesn't have yet. ### [CVE-2026-42091](https://cve.now/CVE-2026-42091): goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS - Severity: Medium 6.5 - Published: May 4, 2026 - Affected: fixed in 2.0.2. - No fix released. The advisory names 2.0.2 as the fix, which the registry doesn't have yet. The latest release, v2.0.0, is still affected. ### [CVE-2026-40885](https://cve.now/CVE-2026-40885): goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access - Severity: High 7.7 - Published: Apr 21, 2026 - Affected: from 2.0.0-beta.4, fixed in 2.0.0-beta.6. - Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure, the advisory names 2.0.0-beta.6, which was never published). - The latest release, v2.0.0, is not affected. ### [CVE-2026-40884](https://cve.now/CVE-2026-40884): goshs: Empty-username SFTP password authentication bypass in goshs - Severity: Critical 9.8 - Published: Apr 21, 2026 - Affected: fixed in 2.0.0. - Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure). - The latest release, v2.0.0, is not affected. ### [CVE-2026-40883](https://cve.now/CVE-2026-40883): goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation - Severity: Medium 6.1 - Published: Apr 21, 2026 - Affected: from 2.0.0-beta.4, fixed in 2.0.0-beta.6. - Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure, the advisory names 2.0.0-beta.6, which was never published). - The latest release, v2.0.0, is not affected. ### [CVE-2026-40876](https://cve.now/CVE-2026-40876): SFTP root escape via prefix-based path validation in goshs - Severity: High 8.7 - Published: Apr 21, 2026 - Affected: fixed in 2.0.0. - Fixed in v2.0.0 (released Apr 14, 2026, 7 days before disclosure). - The latest release, v2.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/patrickhener/goshs/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.