Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

Description

References

• patrickhener/goshs security advisory · ADVISORY

More vulnerabilities in github.com/patrickhener/goshs

• CVE-2026-66064MEDIUM 5.3goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler…
• CVE-2026-66063MEDIUM 6.5goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload …
• CVE-2026-64863CRITICAL 9.1goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled W…
• CVE-2026-54719HIGH 7.5goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload hand…
• CVE-2026-42091MEDIUM 6.5goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token valida…