github.com/patrickhener/goshs vulnerabilities (Go)

17 vulnerabilities.

• github.com/patrickhener/goshs Go goshs has ACL Bypass & Path Traversal CVE-2026-66064 Fix available 5.3 MediumJuly 28, 2026
• github.com/patrickhener/goshs Go goshs has a Path Traversal issue CVE-2026-66063 Fix available 6.5 MediumJuly 28, 2026
• github.com/patrickhener/goshs Go goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite CVE-2026-64863 Fix available 9.1 CriticalJuly 28, 2026
• github.com/patrickhener/goshs Go goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) CVE-2026-54719 Fix available 7.5 HighJuly 28, 2026
• github.com/patrickhener/goshs Go goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS CVE-2026-42091 Fix available 6.5 MediumApril 23, 2026
• github.com/patrickhener/goshs Go Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint GHSA-7qx6-f23w-3w7f 0.0 NoneApril 14, 2026
• github.com/patrickhener/goshs Go goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access CVE-2026-40885 Fix available 7.7 HighApril 14, 2026
• github.com/patrickhener/goshs Go goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation CVE-2026-40883 Fix available 6.1 MediumApril 14, 2026
• github.com/patrickhener/goshs Go goshs: Empty-username SFTP password authentication bypass in goshs CVE-2026-40884 Fix available 9.8 CriticalApril 14, 2026
• github.com/patrickhener/goshs Go SFTP root escape via prefix-based path validation in goshs CVE-2026-40876 Fix available 8.7 HighApril 14, 2026
• github.com/patrickhener/goshs Go goshs has a file-based ACL authorization bypass in goshs state-changing routes CVE-2026-40189 9.3 CriticalApril 10, 2026
• github.com/patrickhener/goshs Go goshs is Missing Write Protection for Parametric Data Values CVE-2026-40188 7.7 HighApril 10, 2026
• github.com/patrickhener/goshs Go Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVE-2026-35471 Fix available 9.8 CriticalApril 3, 2026
• github.com/patrickhener/goshs Go Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393 Fix available 9.8 CriticalApril 3, 2026
• github.com/patrickhener/goshs Go goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392 Fix available 9.8 CriticalApril 3, 2026
• github.com/patrickhener/goshs Go goshs has Auth Bypass via Share Token CVE-2026-34581 8.1 HighApril 1, 2026
• github.com/patrickhener/goshs Go goshs route not protected, allows command execution CVE-2025-46816 Public exploitFix available 9.4 CriticalMay 6, 2025