Security
فارسی
All products

github.com/patrickhener/goshs

Go · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)CVE-2026-54719 · GHSA-RMXW-PQ4X-3FVHVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported
goshs has a Path Traversal issueCVE-2026-66063 · GHSA-WG2Q-39H6-66X9Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs has ACL Bypass & Path TraversalCVE-2026-66064 · GHSA-964W-F6GJ-5236Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwriteCVE-2026-64863 · GHSA-HQ33-8JGP-8QQ3Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Critical Fix reported
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSCVE-2026-42091 · GHSA-RHF7-WVW3-VJVMVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs has a file-based ACL authorization bypass in goshs state-changing routesCVE-2026-40189 · GHSA-WVHV-QCQF-F3CXVersion ranges need review. github.com/patrickhener/goshs Go Critical No fix reported
goshs has Auth Bypass via Share TokenCVE-2026-34581 · GHSA-JGFX-74G2-9R6GVersion ranges need review. github.com/patrickhener/goshs Go High No fix reported
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadCVE-2026-35393 · GHSA-JG56-WF8X-QRV5Version ranges need review. github.com/patrickhener/goshs Go Critical Fix reported
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creationCVE-2026-40883 · GHSA-JRQ5-HG6X-J6G3Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpointGHSA-7QX6-F23W-3W7F · GO-2026-5232Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Low No fix reported
goshs has an empty-username SFTP password authentication bypassCVE-2026-40884 · GHSA-C29W-QQ4M-2GCVVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Critical Fix reported
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)CVE-2026-35471 · GHSA-6QCC-6Q27-WHP8Version ranges need review. github.com/patrickhener/goshs Go Critical Fix reported
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized accessCVE-2026-40885 · GHSA-7H3J-592V-JCRPVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadCVE-2026-35392 · GHSA-G8MV-VP7J-QP64Version ranges need review. github.com/patrickhener/goshs Go Critical Fix reported
SFTP root escape via prefix-based path validation in goshsCVE-2026-40876 · GHSA-5H6H-7RC9-3824Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported
goshs is Missing Write Protection for Parametric Data ValuesCVE-2026-40188 · GHSA-2943-CRP8-38XXVersion ranges need review. github.com/patrickhener/goshs Go High No fix reported
goshs route not protected, allows command executionCVE-2025-46816 · GHSA-RWJ2-W85G-5CMMVersion ranges need review. github.com/patrickhener/goshs Go Critical Fix reported