Loading story…
Two high-severity vulnerabilities were disclosed in goshs, a Go-based SimpleHTTPServer, affecting multiple pre-release and stable versions. CVE-2026-34581 impacts versions 1.1.0 through before 2.0.0-beta.2 and allows attackers to abuse the Share Token feature to bypass download restrictions. The flaw can expose broader goshs functionality beyond intended file access controls and may lead to code execution. The issue is classified as CWE-288 and was fixed in 2.0.0-beta.2.
A second flaw, CVE-2026-40903, affects goshs versions before 2.0.0-beta.6 and is described as an ArtiPACKED vulnerability that can leak GITHUB_TOKEN values through GitHub Actions workflow artifacts, even when the token does not appear in repository source code. The issue is mapped to CWE-829 and carries high confidentiality and integrity impact, extending concern from application access control to CI/CD credential exposure. The vendor lists 2.0.0-beta.6 as the fix version, and a GitHub security advisory has been published.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-21, CVE-2026-40903 was published for goshs, describing an ArtiPACKED vulnerability that could expose GITHUB_TOKEN values through workflow artifacts in versions before 2.0.0-beta.6. The vendor indicated the issue was remediated in goshs version 2.0.0-beta.6 and referenced a GitHub security advisory.
On 2026-04-02, a security advisory disclosed CVE-2026-34581 affecting goshs versions 1.1.0 through before 2.0.0-beta.2. The flaw lets attackers abuse the Share Token feature to bypass download restrictions and potentially gain broader functionality including code execution; the issue was fixed in version 2.0.0-beta.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-35392** and **CVE-2026-35393**, were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting versions prior to **`2.0.0-beta.3`**. Both issues are classified as **CWE-22 path traversal** flaws that arise from missing pathname sanitization in file upload functionality: **PUT** upload handling in `httpserver/updown.go` and **POST multipart** upload directory processing. The weaknesses could allow remote, unauthenticated attackers to write files outside intended directories. Both CVEs carry the same **CVSS v3** vector, **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability. The vulnerabilities were addressed in **`2.0.0-beta.3`**, and related GitHub security advisories were published alongside the fixes. Organizations using goshs for file upload workflows should prioritize upgrading and review exposed instances for unauthorized file placement or tampering.
Jun 29, 2026
A high-severity authentication bypass in **goshs** lets remote users access the built-in SFTP service without credentials under a specific startup configuration. Tracked as **`CVE-2026-62325`**, the flaw affects versions **2.1.3 through before 2.1.4** and occurs when goshs is launched with a username and empty password, such as: ```bash -b 'admin:' -sftp ``` If the service is also started without configured authorized keys, the SFTP password authentication handler may never be registered, leaving the underlying **`gliderlabs/ssh`** framework to permit anonymous access.
Jul 29, 2026
A critical vulnerability tracked as **CVE-2026-64863** affects **goshs** before version **2.1.4**, allowing unauthenticated remote attackers to bypass the server’s `--no-delete` and `--upload-only` protections through flawed WebDAV request handling. The issue stems from `MOVE` being treated as a write-only method without properly enforcing deletion restrictions, while `COPY` operations were also insufficiently constrained. An attacker could use crafted WebDAV requests to move, overwrite, or effectively delete files, including by sending `MOVE` requests with the `Overwrite: T` header. The flaw is classified as **CWE-284** and has been rated high to critical severity, with reports citing **CVSS 9.1** and a published vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`. The vendor fixed the issue in **goshs 2.1.4** through commit `0444ac6b1a8176ddae70d940adf7a26b2e5a6c29`, adding a dedicated `webdavGuard` middleware to enforce separate restrictions for `MOVE` and `COPY`. Reporting also noted residual edge cases involving broken symbolic links and possible path-normalization discrepancies, underscoring the need for users to upgrade promptly.
Jul 29, 2026