goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs

Description

References

• patrickhener/goshs security advisory · ADVISORY
• patrickhener/goshs commit 8f409cb · WEB
• patrickhener/goshs release v2.0.7 · WEB

Autres vulnérabilités de goshs.de/goshs

• CVE-2026-50139MOYENNE 5.9goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, rel…
• CVE-2026-50138ÉLEVÉE 8.1goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction…
• CVE-2026-66064MOYENNE 5.3goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler…
• CVE-2026-66063MOYENNE 6.5goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload …
• CVE-2026-64863CRITIQUE 9.1goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled W…