CVE-2026-34581

Published: Apr 2, 2026Modified: Jul 24, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

Affected (2)

Products: Goshs: Goshs

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Goshs Goshs	From 1.1.0 to 2.0.0
Goshs Goshs	Version 2.0.0 beta1

Related CWEs

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (3)

https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216

Source: security-advisories@github.com

Patch

https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.