CVE-2026-40884: falha crítica em patrickhener goshs
goshs: Empty-username SFTP password authentication bypass in goshs
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.5%
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
patrickhener · goshsCVEs relacionadas — patrickhener goshs
No mesmo produto, das mais perigosas para as menos.
CVE-2025-46816CRITICALgoshs route not protected, allows command executionEPSS 0.7%CVE-2026-35471CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsEPSS 0.7%CVE-2026-35393CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadEPSS 0.7%CVE-2026-35392CRITICALgoshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadEPSS 0.7%CVE-2026-40189CRITICALgoshs has a file-based ACL authorization bypass in goshs state-changing routesEPSS 0.6%CVE-2026-40876HIGHSFTP root escape via prefix-based path validation in goshsEPSS 0.4%