goshs-labs vulnerabilities and threats

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.

CVE-2026-64863 is an improper access control vulnerability in goshs, a single-binary file server. Versions prior to 2.1.4 incorrectly handled WebDAV MOVE requests, allowing deletion or overwriting of files despite the --no-delete option. This issue is fixed in version 2.1.4.

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

CVE-2026-62325 is a critical vulnerability in goshs, a single-binary file server, affecting versions from 2.1.3 up to but not including 2.1.4. The issue arises from improper authentication checks in the SFTP password handler, allowing unauthenticated file access when certain flags are used. This vulnerability is fixed in version 2.1.4.