CVE-2026-40884
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-26)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- goshs:goshs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c29w-qq4m-2gcv | Go | github.com/patrickhener/goshs | <=1.1.4 | no fix published |
| GHSA-c29w-qq4m-2gcv | Go | github.com/patrickhener/goshs/v2 | <2.0.0 | 2.0.0 |
| GO-2026-5303 | Go | github.com/patrickhener/goshs | all versions | no fix published |
| GO-2026-5303 | Go | github.com/patrickhener/goshs/v2 | <2.0.0 | 2.0.0 |