goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
References
| Link | Resource |
|---|---|
| https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv | Exploit Vendor Advisory |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:* |
|
| First Time |
Goshs goshs
Goshs |
22 Apr 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv - |
21 Apr 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 20:17
Updated : 2026-04-27 14:55
NVD link : CVE-2026-40884
Mitre link : CVE-2026-40884
CVE.ORG link : CVE-2026-40884
JSON object : View
Products Affected
goshs
- goshs
CWE
CWE-306
Missing Authentication for Critical Function