Loading story…
A high-severity authentication bypass in goshs lets remote users access the built-in SFTP service without credentials under a specific startup configuration. Tracked as CVE-2026-62325, the flaw affects versions 2.1.3 through before 2.1.4 and occurs when goshs is launched with a username and empty password, such as:
-b 'admin:' -sftp
If the service is also started without configured authorized keys, the SFTP password authentication handler may never be registered, leaving the underlying gliderlabs/ssh framework to permit anonymous access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A fix for CVE-2026-62325 was released in goshs version 2.1.4. The vulnerability allowed unauthenticated SFTP access when goshs was run with a username and empty password and no authorized keys configured.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting multiple pre-release and stable versions. `CVE-2026-34581` impacts versions `1.1.0` through before `2.0.0-beta.2` and allows attackers to abuse the Share Token feature to bypass download restrictions. The flaw can expose broader goshs functionality beyond intended file access controls and may lead to **code execution**. The issue is classified as `CWE-288` and was fixed in `2.0.0-beta.2`. A second flaw, `CVE-2026-40903`, affects goshs versions before `2.0.0-beta.6` and is described as an **ArtiPACKED** vulnerability that can leak `GITHUB_TOKEN` values through GitHub Actions workflow artifacts, even when the token does not appear in repository source code. The issue is mapped to `CWE-829` and carries high confidentiality and integrity impact, extending concern from application access control to CI/CD credential exposure. The vendor lists `2.0.0-beta.6` as the fix version, and a GitHub security advisory has been published.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-35392** and **CVE-2026-35393**, were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting versions prior to **`2.0.0-beta.3`**. Both issues are classified as **CWE-22 path traversal** flaws that arise from missing pathname sanitization in file upload functionality: **PUT** upload handling in `httpserver/updown.go` and **POST multipart** upload directory processing. The weaknesses could allow remote, unauthenticated attackers to write files outside intended directories. Both CVEs carry the same **CVSS v3** vector, **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability. The vulnerabilities were addressed in **`2.0.0-beta.3`**, and related GitHub security advisories were published alongside the fixes. Organizations using goshs for file upload workflows should prioritize upgrading and review exposed instances for unauthorized file placement or tampering.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-64863** affects **goshs** before version **2.1.4**, allowing unauthenticated remote attackers to bypass the server’s `--no-delete` and `--upload-only` protections through flawed WebDAV request handling. The issue stems from `MOVE` being treated as a write-only method without properly enforcing deletion restrictions, while `COPY` operations were also insufficiently constrained. An attacker could use crafted WebDAV requests to move, overwrite, or effectively delete files, including by sending `MOVE` requests with the `Overwrite: T` header. The flaw is classified as **CWE-284** and has been rated high to critical severity, with reports citing **CVSS 9.1** and a published vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`. The vendor fixed the issue in **goshs 2.1.4** through commit `0444ac6b1a8176ddae70d940adf7a26b2e5a6c29`, adding a dedicated `webdavGuard` middleware to enforce separate restrictions for `MOVE` and `COPY`. Reporting also noted residual edge cases involving broken symbolic links and possible path-normalization discrepancies, underscoring the need for users to upgrade promptly.
Jul 29, 2026