HIGH8.8Go
GHSA-5h6h-7rc9-3824· CVE-2026-40876, GO-2026-5146SFTP root escape via prefix-based path validation in goshs
Modified: 6/25/2026
package
Go/github.com/patrickhener/goshs/v2
pkg:go/github.com/patrickhener/goshs/v2
HIGH8.8Go
GHSA-7h3j-592v-jcrp· CVE-2026-40885, GO-2026-5221goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
Modified: 6/25/2026
—0.0Go
GHSA-7qx6-f23w-3w7f· GO-2026-5232Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint
Modified: 6/25/2026
MEDIUM5.3Go
GHSA-964w-f6gj-5236· CVE-2026-66064, GO-2026-6134goshs has ACL Bypass & Path Traversal
Modified: 8/18/2026
CRITICAL9.8Go
GHSA-c29w-qq4m-2gcv· CVE-2026-40884, GO-2026-5303goshs has an empty-username SFTP password authentication bypass
Modified: 6/25/2026
CRITICAL9.1Go
GHSA-hq33-8jgp-8qq3· CVE-2026-64863, GO-2026-6136goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
Modified: 8/18/2026
HIGH8.1Go
GHSA-jrq5-hg6x-j6g3· CVE-2026-40883, GO-2026-5479goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-rhf7-wvw3-vjvm· CVE-2026-42091, GO-2026-5625goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
Modified: 6/25/2026
CRITICAL9.1Go
GHSA-rjrw-mjq6-hpmm· CVE-2026-62325, GO-2026-6132goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
Modified: 8/18/2026
HIGH7.5Go
GHSA-rmxw-pq4x-3fvh· CVE-2026-54719, GO-2026-6133goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
Modified: 8/18/2026
MEDIUM6.5Go
GHSA-wg2q-39h6-66x9· CVE-2026-66063, GO-2026-6137goshs has a Path Traversal issue
Modified: 8/18/2026
—Go
GO-2026-5146· CVE-2026-40876, GHSA-5h6h-7rc9-3824SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5221· CVE-2026-40885, GHSA-7h3j-592v-jcrpgoshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5232· GHSA-7qx6-f23w-3w7fUnauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5303· CVE-2026-40884, GHSA-c29w-qq4m-2gcvgoshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5479· CVE-2026-40883, GHSA-jrq5-hg6x-j6g3goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs
Modified: 6/25/2026