goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs

概要

参考情報

• patrickhener/goshs security advisory · ADVISORY
• patrickhener/goshs commit 8f409cb · WEB
• patrickhener/goshs release v2.0.7 · WEB

goshs.de/goshs のその他の脆弱性

• CVE-2026-50139中 5.9goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, rel…
• CVE-2026-50138高 8.1goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction…
• CVE-2026-66064中 5.3goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler…
• CVE-2026-66063中 6.5goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload …
• CVE-2026-64863緊急 9.1goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled W…