github.com/patrickhener/goshs/v2 vulnerabilities (Go)
11 vulnerabilities.
-
github.com/patrickhener/goshs/v2Go goshs has ACL Bypass & Path Traversal 5.3 Medium -
github.com/patrickhener/goshs/v2Go goshs has a Path Traversal issue 6.5 Medium -
github.com/patrickhener/goshs/v2Go goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite 9.1 Critical -
github.com/patrickhener/goshs/v2Go goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) 7.5 High -
github.com/patrickhener/goshs/v2Go goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) 9.1 Critical -
github.com/patrickhener/goshs/v2Go goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS 6.5 Medium -
github.com/patrickhener/goshs/v2Go Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint 0.0 None -
github.com/patrickhener/goshs/v2Go goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access 7.7 High -
github.com/patrickhener/goshs/v2Go goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation 6.1 Medium -
github.com/patrickhener/goshs/v2Go goshs: Empty-username SFTP password authentication bypass in goshs 9.8 Critical -
github.com/patrickhener/goshs/v2Go SFTP root escape via prefix-based path validation in goshs 8.7 High