Vulnerability record · CVE-2026-34581 · published 2 April 2026

CVE-2026-34581: Goshs authentication bypass via alternate path vulnerability

Goshs · Goshs

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

8.1 CVSS 3.1 High EPSS 0.45% · top 63.2% CWE-288 · Authentication bypass via alternate path

8.1CVSS 3.1 base score

0.45%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 1 tagged exploit

24 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Goshs Goshs

References

Link	Tags
https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216	Patch
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2	ProductRelease Notes
https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g	ExploitVendor Advisory

Track CVE-2026-34581 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-40884Goshs missing authentication for critical function vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username bas…EPSS 0.65%21 Apr 2026 9.8CVE-2026-35471Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixe…EPSS 0.69%6 Apr 2026 9.8CVE-2026-35392Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is …EPSS 0.69%6 Apr 2026 9.8CVE-2026-35393Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2…EPSS 0.69%6 Apr 2026 9.3CVE-2026-40189Goshs missing authorization vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for direct…EPSS 0.66%10 Apr 2026 9.1CVE-2026-40903Goshs inclusion from untrusted sphere vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB…EPSS 0.43%21 Apr 2026 8.7CVE-2026-40876Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authe…EPSS 0.59%21 Apr 2026 7.7CVE-2026-40885Goshs information exposure vulnerabilitygoshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator …EPSS 0.45%21 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2026-34581), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.