goshs vulnerabilities

3 known vulnerabilities in goshs from Goshs-labs. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  goshs: Improper Access Control

  CVE-2026-64863Jul 28, 2026Goshs-labs

  goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files

• 9.1 Critical severity

  goshs: Missing Authentication for Critical Functionality

  CVE-2026-62325Jul 28, 2026Goshs-labs

  goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP au

• 7.5 High severity

  goshs: Missing Authorization

  CVE-2026-54719Jul 28, 2026Goshs-labs

  goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of fi