CVE-2026-34581: CWE-288: Authentication Bypass Using an Alternate Path or Channel in patrickhener goshs
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-34581 affects goshs, a SimpleHTTPServer implemented in Go by patrickhener. In versions 1.1.0 through before 2.0.0-beta.2, the Share Token mechanism intended to restrict file downloads can be bypassed, allowing unauthorized users to access all server functionalities, including executing arbitrary code. This constitutes an authentication bypass via an alternate path or channel (CWE-288). The vulnerability has been addressed in version 2.0.0-beta.2.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass Share Token restrictions, gaining unauthorized access to all goshs functionalities, including the ability to execute arbitrary code. This can lead to full compromise of the affected server environment. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with no required privileges and low attack complexity.
Mitigation Recommendations
Upgrade goshs to version 2.0.0-beta.2 or later, where this authentication bypass vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-34581: CWE-288: Authentication Bypass Using an Alternate Path or Channel in patrickhener goshs
Description
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-34581 affects goshs, a SimpleHTTPServer implemented in Go by patrickhener. In versions 1.1.0 through before 2.0.0-beta.2, the Share Token mechanism intended to restrict file downloads can be bypassed, allowing unauthorized users to access all server functionalities, including executing arbitrary code. This constitutes an authentication bypass via an alternate path or channel (CWE-288). The vulnerability has been addressed in version 2.0.0-beta.2.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass Share Token restrictions, gaining unauthorized access to all goshs functionalities, including the ability to execute arbitrary code. This can lead to full compromise of the affected server environment. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity with no required privileges and low attack complexity.
Mitigation Recommendations
Upgrade goshs to version 2.0.0-beta.2 or later, where this authentication bypass vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T16:56:30.999Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69ceb81be6bfc5ba1df6de8b
Added to database: 4/2/2026, 6:40:27 PM
Last enriched: 4/9/2026, 10:44:08 PM
Last updated: 5/20/2026, 8:51:27 PM
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.