# goshs.de/goshs (Go) vulnerabilities

8 known vulnerabilities (2 critical, 2 high, 4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/goshs.de/goshs

## Advisories (8)

### [CVE-2026-50139](https://cve.now/CVE-2026-50139): goshs: Share-link ?token=… redemption races past download limit

- Severity: Medium 5.9
- Published: Aug 18, 2026
- Affected: all versions.

### [CVE-2026-50138](https://cve.now/CVE-2026-50138): goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

- Severity: High 8.1
- Published: Aug 18, 2026
- Affected: all versions.

### [CVE-2026-66064](https://cve.now/CVE-2026-66064): goshs has ACL Bypass & Path Traversal

- Severity: Medium 5.3
- Published: Jul 28, 2026
- Affected: through 1.1.4; all versions.

### [CVE-2026-66063](https://cve.now/CVE-2026-66063): goshs has a Path Traversal issue

- Severity: Medium 6.5
- Published: Jul 28, 2026
- Affected: through 1.1.4; all versions.

### [CVE-2026-64863](https://cve.now/CVE-2026-64863): goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

- Severity: Critical 9.1
- Published: Jul 28, 2026
- Affected: through 1.1.4; all versions.

### [CVE-2026-54719](https://cve.now/CVE-2026-54719): goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

- Severity: High 7.5
- Published: Jul 28, 2026
- Affected: through 1.1.4; all versions.

### [CVE-2026-62325](https://cve.now/CVE-2026-62325): goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

- Severity: Critical 9.1
- Published: Jul 28, 2026
- Affected: all versions.

### [CVE-2026-42091](https://cve.now/CVE-2026-42091): goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

- Severity: Medium 6.5
- Published: May 4, 2026
- Affected: all versions.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/goshs.de/goshs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.