Security
فارسی
All products

github.com/patrickhener/goshs/v2

Go · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)CVE-2026-54719 · GHSA-RMXW-PQ4X-3FVHVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported
goshs has a Path Traversal issueCVE-2026-66063 · GHSA-WG2Q-39H6-66X9Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs has ACL Bypass & Path TraversalCVE-2026-66064 · GHSA-964W-F6GJ-5236Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)CVE-2026-62325 · GHSA-RJRW-MJQ6-HPMMVersion ranges need review. github.com/patrickhener/goshs/v2goshs.de/goshs/v2 Go Critical Fix reported
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwriteCVE-2026-64863 · GHSA-HQ33-8JGP-8QQ3Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Critical Fix reported
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSCVE-2026-42091 · GHSA-RHF7-WVW3-VJVMVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creationCVE-2026-40883 · GHSA-JRQ5-HG6X-J6G3Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Medium Fix reported
Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpointGHSA-7QX6-F23W-3W7F · GO-2026-5232Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Low No fix reported
goshs has an empty-username SFTP password authentication bypassCVE-2026-40884 · GHSA-C29W-QQ4M-2GCVVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go Critical Fix reported
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized accessCVE-2026-40885 · GHSA-7H3J-592V-JCRPVersion ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported
SFTP root escape via prefix-based path validation in goshsCVE-2026-40876 · GHSA-5H6H-7RC9-3824Version ranges need review. github.com/patrickhener/goshs/v2github.com/patrickhener/goshs Go High Fix reported