Skip to main content
cve.nowby Sazabi
← Go
GoPackage

goshs.de/goshs

8 known vulnerabilities (2 critical, 2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 critical, 2 high, 4 medium
Registry
pkg.go.dev

Advisories 8

  • CVE-2026-50139Medium 5.9

    goshs: Share-link ?token=… redemption races past download limit

    Affected: all versions.

  • goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

    Affected: all versions.

  • CVE-2026-66064Medium 5.3

    goshs has ACL Bypass & Path Traversal

    Affected: through 1.1.4; all versions.

  • CVE-2026-66063Medium 6.5

    goshs has a Path Traversal issue

    Affected: through 1.1.4; all versions.

  • CVE-2026-64863Critical 9.1

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    Affected: through 1.1.4; all versions.

  • goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    Affected: through 1.1.4; all versions.

  • CVE-2026-62325Critical 9.1

    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

    Affected: all versions.

  • CVE-2026-42091Medium 6.5

    goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

    Affected: all versions.