HIGH7.7Go
GHSA-2943-crp8-38xx· CVE-2026-40188, GO-2026-4953goshs is Missing Write Protection for Parametric Data Values
Modified: 6/8/2026
package
Go/github.com/patrickhener/goshs
pkg:go/github.com/patrickhener/goshs
HIGH8.8Go
GHSA-5h6h-7rc9-3824· CVE-2026-40876, GO-2026-5146SFTP root escape via prefix-based path validation in goshs
Modified: 6/25/2026
CRITICAL9.8Go
GHSA-6qcc-6q27-whp8· CVE-2026-35471, GO-2026-5186goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Modified: 6/25/2026
—0.0Go
GHSA-7qx6-f23w-3w7f· GO-2026-5232Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint
Modified: 6/25/2026
MEDIUM5.3Go
GHSA-964w-f6gj-5236· CVE-2026-66064, GO-2026-6134goshs has ACL Bypass & Path Traversal
Modified: 8/18/2026
CRITICAL9.8Go
GHSA-c29w-qq4m-2gcv· CVE-2026-40884, GO-2026-5303goshs has an empty-username SFTP password authentication bypass
Modified: 6/25/2026
CRITICAL9.8Go
GHSA-g8mv-vp7j-qp64· CVE-2026-35392, GO-2026-5394goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
Modified: 6/25/2026
CRITICAL9.1Go
GHSA-hq33-8jgp-8qq3· CVE-2026-64863, GO-2026-6136goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
Modified: 8/18/2026
CRITICAL9.8Go
GHSA-jg56-wf8x-qrv5· CVE-2026-35393, GO-2026-5468goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
Modified: 6/25/2026
HIGH8.1Go
GHSA-jgfx-74g2-9r6g· CVE-2026-34581, GO-2026-5469goshs has Auth Bypass via Share Token
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-rhf7-wvw3-vjvm· CVE-2026-42091, GO-2026-5625goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
Modified: 6/25/2026
HIGH7.5Go
GHSA-rmxw-pq4x-3fvh· CVE-2026-54719, GO-2026-6133goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
Modified: 8/18/2026
CRITICAL9.4Go
GHSA-rwj2-w85g-5cmm· CVE-2025-46816, GO-2025-3672goshs route not protected, allows command execution
Modified: 5/15/2025
MEDIUM6.5Go
GHSA-wg2q-39h6-66x9· CVE-2026-66063, GO-2026-6137goshs has a Path Traversal issue
Modified: 8/18/2026
CRITICAL9.8Go
GHSA-wvhv-qcqf-f3cx· CVE-2026-40189, GO-2026-5728goshs has a file-based ACL authorization bypass in goshs state-changing routes
Modified: 6/25/2026
—Go
GO-2025-3672· CVE-2025-46816, GHSA-rwj2-w85g-5cmmgoshs route not protected, allows command execution in github.com/patrickhener/goshs
Modified: 3/3/2026
—Go
GO-2026-4953· CVE-2026-40188, GHSA-2943-crp8-38xxgoshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs
Modified: 5/20/2026
—Go
GO-2026-5146· CVE-2026-40876, GHSA-5h6h-7rc9-3824SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5186· CVE-2026-35471, GHSA-6qcc-6q27-whp8goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5221· CVE-2026-40885, GHSA-7h3j-592v-jcrpgoshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5232· GHSA-7qx6-f23w-3w7fUnauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5303· CVE-2026-40884, GHSA-c29w-qq4m-2gcvgoshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5394· CVE-2026-35392, GHSA-g8mv-vp7j-qp64goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5468· CVE-2026-35393, GHSA-jg56-wf8x-qrv5goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5469· CVE-2026-34581, GHSA-jgfx-74g2-9r6ggoshs has Auth Bypass via Share Token in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5479· CVE-2026-40883, GHSA-jrq5-hg6x-j6g3goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5625· CVE-2026-42091, GHSA-rhf7-wvw3-vjvmgoshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5728· CVE-2026-40189, GHSA-wvhv-qcqf-f3cxgoshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-6133· CVE-2026-54719, GHSA-rmxw-pq4x-3fvhgoshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6134· CVE-2026-66064, GHSA-964w-f6gj-5236goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6136· CVE-2026-64863, GHSA-hq33-8jgp-8qq3goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6137· CVE-2026-66063, GHSA-wg2q-39h6-66x9goshs has a Path Traversal issue in github.com/patrickhener/goshs
Modified: 8/18/2026