CVE-2026-34581

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216	Patch
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2	Product Release Notes
https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:goshs:goshs::::::go::*
	cpe:2.3:a:goshs:goshs:2.0.0:beta1::::go::*

History

No history.

Information

Published : 2026-04-02 19:21

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34581

Mitre link : CVE-2026-34581

CVE.ORG link : CVE-2026-34581

JSON object : View

Products Affected

goshs

goshs

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2026-34581", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34581", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T16:19:09.570992Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"status": "affected", "version": ">= 1.1.0, < 2.0.0-beta.2"}]}]}], "published": "2026-04-02T19:21:32.157", "references": [{"url": "https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2."}, {"lang": "es", "value": "goshs es un servidor HTTP simple escrito en Go. Desde la versi\u00f3n 1.1.0 hasta antes de la versi\u00f3n 2.0.0-beta.2, al usar el Token de Compartir es posible eludir la descarga limitada de archivos seleccionados con todas las funcionalidades de gosh, incluyendo la ejecuci\u00f3n de c\u00f3digo. Este problema ha sido parcheado en la versi\u00f3n 2.0.0-beta.2."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "EE028980-59D0-49E3-81A8-BB9E32D3FC9F", "versionEndExcluding": "2.0.0", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "047ECFC3-056F-4FAC-9B64-5F7C120CFFE1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}