Goshs-labs vulnerabilities
We track 3 vulnerabilities in Goshs-labs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest Goshs-labs vulnerabilities
- 9.1 Critical severity
goshs: Improper Access Control
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files
- 9.1 Critical severity
goshs: Missing Authentication for Critical Functionality
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP au
- 7.5 High severity
goshs: Missing Authorization
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of fi