CVE-2026-40884

Published: Apr 21, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Affected (6)

Products: Goshs: Goshs

Goshs

1 product

Goshs

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Goshs Goshs	Before 2.0.0
Goshs Goshs	Version 2.0.0 beta1
Goshs Goshs	Version 2.0.0 beta2
Goshs Goshs	Version 2.0.0 beta3
Goshs Goshs	Version 2.0.0 beta4
Goshs Goshs	Version 2.0.0 beta5

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.