VulnerabilityAnalyzed

CVE-2026-34581

From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec.

HIGH 8.1EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS: 0.39% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-288
Affected: goshs/goshs
Source: security-advisories@github.com

References

https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216Patch
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2Product, Release Notes
https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6gExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.