CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 28/07/2026 |
| CVE-2026-66063 | MOYENNE6.5 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in versi | 28/07/2026 |
| CVE-2026-64863 | CRITIQUE9.1 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2 | 28/07/2026 |
| CVE-2026-62325 | CRITIQUE9.1 | goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file | 28/07/2026 |
| CVE-2026-54719 | ÉLEVÉE7.5 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. Th | 28/07/2026 |
| GO-2026-5519 | goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs | 25/06/2026 |
| GHSA-mxg3-432p-mr72 | ÉLEVÉE7.4 | goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request | 15/05/2026 |
| CVE-2026-42091 | MOYENNE6.5 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (https | 04/05/2026 |