Vulnerability record · CVE-2026-40885 · published 21 April 2026

CVE-2026-40885: Goshs information exposure vulnerability

Goshs · Goshs

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.

7.7 CVSS 4.0 High EPSS 0.45% · top 63.3% CWE-200 · Information exposure

7.7CVSS 4.0 base score

0.45%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Goshs Goshs

References

Link	Tags
https://github.com/patrickhener/goshs/security/advisories/GHSA-7h3j-592v-jcrp	ExploitVendor Advisory
https://github.com/patrickhener/goshs/security/advisories/GHSA-7h3j-592v-jcrp	ExploitVendor Advisory

Track CVE-2026-40885 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-40884Goshs missing authentication for critical function vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username bas…EPSS 0.65%21 Apr 2026 9.8CVE-2026-35471Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixe…EPSS 0.69%6 Apr 2026 9.8CVE-2026-35392Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is …EPSS 0.69%6 Apr 2026 9.8CVE-2026-35393Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2…EPSS 0.69%6 Apr 2026 9.3CVE-2026-40189Goshs missing authorization vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for direct…EPSS 0.66%10 Apr 2026 9.1CVE-2026-40903Goshs inclusion from untrusted sphere vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB…EPSS 0.43%21 Apr 2026 8.7CVE-2026-40876Goshs path traversal vulnerabilitygoshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authe…EPSS 0.59%21 Apr 2026 8.1CVE-2026-34581Goshs authentication bypass via alternate path vulnerabilitygoshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the…EPSS 0.45%2 Apr 2026

Source: NIST National Vulnerability Database (record CVE-2026-40885), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.