Skip to content
Threat Feed
Subscribe

Product

Goshs

3 briefs RSS
high advisory

Goshs File-Based ACL Authorization Bypass via Bulk Zip Download

An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.

goshs +1 authorization-bypass webserver vulnerability cve information-disclosure
1r 3t
high advisory

goshs SSH Tunnel Vulnerable to MITM via Insecure Host Key Handling

The goshs application disables SSH host key verification when using the --tunnel flag, making it vulnerable to man-in-the-middle attacks that expose plaintext HTTP traffic.

goshs/v2 <= 2.0.6 mitm ssh insecure-configuration
2r 6t
high advisory

goshs SimpleHTTPServer SFTP Rename Path Traversal Vulnerability (CVE-2026-40188)

The goshs SimpleHTTPServer, from version 1.0.7 to before 2.0.0-beta.4, is vulnerable to path traversal (CVE-2026-40188) due to insufficient sanitization of the destination path in the SFTP rename command, potentially allowing attackers with low privileges to write files outside the intended root directory.

goshs path-traversal sftp cve-2026-40188
2r 1t 1c