Skip to main content
cve.nowby Sazabi
← Go
GoPackage

goshs.de/goshs/v2

8 known vulnerabilities (2 critical, 2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
v2.1.7 (Sep 28, 2026): no advisory affects it
Newest unaffected release
v2.1.7 (Sep 28, 2026), the latest release
Advisories
8 · 2 critical, 2 high, 4 medium
Releases
18 since v2.0.0 (Apr 14, 2026)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2026-50139Medium 5.9

    goshs: Share-link ?token=… redemption races past download limit

    Affected: fixed in 2.1.0.

    Fixed in v2.1.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, v2.1.7, is not affected.

  • goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

    Affected: fixed in 2.1.0.

    Fixed in v2.1.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, v2.1.7, is not affected.

  • CVE-2026-66064Medium 5.3

    goshs has ACL Bypass & Path Traversal

    Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091.

    Fixed in v2.1.5 (released Aug 2, 2026, 5 days after disclosure, the advisory names 2.1.5-0.20260727065949-f3ef599e4091, which was never published).

    The latest release, v2.1.7, is not affected.

  • CVE-2026-66063Medium 6.5

    goshs has a Path Traversal issue

    Affected: fixed in 2.1.5-0.20260727065949-f3ef599e4091.

    Fixed in v2.1.5 (released Aug 2, 2026, 5 days after disclosure, the advisory names 2.1.5-0.20260727065949-f3ef599e4091, which was never published).

    The latest release, v2.1.7, is not affected.

  • CVE-2026-64863Critical 9.1

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    Affected: fixed in 2.1.4.

    Fixed in v2.1.4 (released Jul 3, 2026, 25 days before disclosure).

    The latest release, v2.1.7, is not affected.

  • goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    Affected: fixed in 2.1.1.

    Fixed in v2.1.1 (released Jun 17, 2026, 41 days before disclosure).

    The latest release, v2.1.7, is not affected.

  • CVE-2026-62325Critical 9.1

    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

    Affected: from 2.1.3, fixed in 2.1.4; from 2.1.3, fixed in 2.1.4.

    Fixed in v2.1.4 (released Jul 3, 2026, 25 days before disclosure).

    The latest release, v2.1.7, is not affected.

  • CVE-2026-42091Medium 6.5

    goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

    Affected: fixed in 2.0.2.

    Fixed in v2.0.2 (released Apr 21, 2026, 13 days before disclosure).

    The latest release, v2.1.7, is not affected.