Patrickhener Goshs vulnerabilities

• goshs-labs goshs goshs has ACL Bypass & Path Traversal CVE-2026-66064 Fix available 5.3 MediumJuly 28, 2026
• goshs-labs goshs goshs has a Path Traversal issue CVE-2026-66063 Fix available 6.5 MediumJuly 28, 2026
• goshs-labs goshs goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite CVE-2026-64863 Fix available 9.1 CriticalJuly 28, 2026
• goshs-labs goshs goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189) CVE-2026-54719 Fix available 7.5 HighJuly 28, 2026
• goshs-labs goshs goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) CVE-2026-62325 Fix available 9.1 CriticalJuly 28, 2026
• patrickhener goshs goshs: Share-link ?token=… redemption races past download limit CVE-2026-50139 Fix available 5.9 MediumJuly 1, 2026
• patrickhener goshs goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags CVE-2026-50138 Fix available 8.1 HighJuly 1, 2026
• goshs goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS CVE-2026-42091 Fix available 6.5 MediumApril 23, 2026
• goshs Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence CVE-2026-40903 9.1 CriticalApril 21, 2026
• goshs goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access CVE-2026-40885 Fix available 7.7 HighApril 14, 2026
• goshs goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation CVE-2026-40883 Fix available 6.1 MediumApril 14, 2026
• goshs goshs: Empty-username SFTP password authentication bypass in goshs CVE-2026-40884 Fix available 9.8 CriticalApril 14, 2026
• goshs SFTP root escape via prefix-based path validation in goshs CVE-2026-40876 Fix available 8.7 HighApril 14, 2026
• goshs goshs has a file-based ACL authorization bypass in goshs state-changing routes CVE-2026-40189 9.3 CriticalApril 10, 2026
• goshs goshs is Missing Write Protection for Parametric Data Values CVE-2026-40188 7.7 HighApril 10, 2026
• goshs Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVE-2026-35471 Fix available 9.8 CriticalApril 3, 2026
• goshs Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393 Fix available 9.8 CriticalApril 3, 2026
• goshs goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392 Fix available 9.8 CriticalApril 3, 2026
• goshs goshs has Auth Bypass via Share Token CVE-2026-34581 8.1 HighApril 1, 2026
• patrickhener goshs goshs route not protected, allows command execution CVE-2025-46816 Public exploitFix available 9.4 CriticalMay 6, 2025