Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-66064 (GCVE-0-2026-66064)

Vulnerability from nvd – Published: 2026-07-28 22:12 – Updated: 2026-07-28 22:12

Title

goshs has ACL Bypass & Path Traversal

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-41 - Improper Resolution of Path Equivalence
CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/pull/222	x_refsource_MISC
https://github.com/goshs-labs/goshs/commit/f3ef59…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-41",
              "description": "CWE-41: Improper Resolution of Path Equivalence",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:12:04.830Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/pull/222",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/pull/222"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
        }
      ],
      "source": {
        "advisory": "GHSA-964w-f6gj-5236",
        "discovery": "UNKNOWN"
      },
      "title": "goshs has ACL Bypass \u0026 Path Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66064",
    "datePublished": "2026-07-28T22:12:04.830Z",
    "dateReserved": "2026-07-23T23:25:28.897Z",
    "dateUpdated": "2026-07-28T22:12:04.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66063 (GCVE-0-2026-66063)

Vulnerability from nvd – Published: 2026-07-28 22:07 – Updated: 2026-07-28 22:07

Title

goshs has a Path Traversal issue

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/f3ef59…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:07:15.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
        }
      ],
      "source": {
        "advisory": "GHSA-wg2q-39h6-66x9",
        "discovery": "UNKNOWN"
      },
      "title": "goshs has a Path Traversal issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66063",
    "datePublished": "2026-07-28T22:07:15.558Z",
    "dateReserved": "2026-07-23T23:25:28.897Z",
    "dateUpdated": "2026-07-28T22:07:15.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64863 (GCVE-0-2026-64863)

Vulnerability from nvd – Published: 2026-07-28 22:02 – Updated: 2026-07-28 22:02

Title

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/0444ac…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:02:15.887Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hq33-8jgp-8qq3",
        "discovery": "UNKNOWN"
      },
      "title": "goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64863",
    "datePublished": "2026-07-28T22:02:15.887Z",
    "dateReserved": "2026-07-20T18:31:39.291Z",
    "dateUpdated": "2026-07-28T22:02:15.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62325 (GCVE-0-2026-62325)

Vulnerability from nvd – Published: 2026-07-28 21:52 – Updated: 2026-07-28 21:52

Title

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/32f4a0…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: >= 2.1.3, < 2.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.3, \u003c 2.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != \"\" \u0026\u0026 Password != \"\", so running goshs with -b \u0027admin:\u0027 -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T21:52:05.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-rjrw-mjq6-hpmm",
        "discovery": "UNKNOWN"
      },
      "title": "goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62325",
    "datePublished": "2026-07-28T21:52:05.595Z",
    "dateReserved": "2026-07-13T19:27:58.315Z",
    "dateUpdated": "2026-07-28T21:52:05.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54719 (GCVE-0-2026-54719)

Vulnerability from nvd – Published: 2026-07-28 21:58 – Updated: 2026-07-29 12:32

Title

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization
CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/7cf911…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54719",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T12:32:34.267762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T12:32:38.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk\u0026file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:01:10.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-rmxw-pq4x-3fvh",
        "discovery": "UNKNOWN"
      },
      "title": "goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54719",
    "datePublished": "2026-07-28T21:58:50.208Z",
    "dateReserved": "2026-06-15T23:07:33.231Z",
    "dateUpdated": "2026-07-29T12:32:38.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66064 (GCVE-0-2026-66064)

Vulnerability from cvelistv5 – Published: 2026-07-28 22:12 – Updated: 2026-07-28 22:12

Title

goshs has ACL Bypass & Path Traversal

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-41 - Improper Resolution of Path Equivalence
CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/pull/222	x_refsource_MISC
https://github.com/goshs-labs/goshs/commit/f3ef59…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-41",
              "description": "CWE-41: Improper Resolution of Path Equivalence",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:12:04.830Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/pull/222",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/pull/222"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
        }
      ],
      "source": {
        "advisory": "GHSA-964w-f6gj-5236",
        "discovery": "UNKNOWN"
      },
      "title": "goshs has ACL Bypass \u0026 Path Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66064",
    "datePublished": "2026-07-28T22:12:04.830Z",
    "dateReserved": "2026-07-23T23:25:28.897Z",
    "dateUpdated": "2026-07-28T22:12:04.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66063 (GCVE-0-2026-66063)

Vulnerability from cvelistv5 – Published: 2026-07-28 22:07 – Updated: 2026-07-28 22:07

Title

goshs has a Path Traversal issue

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/f3ef59…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:07:15.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
        }
      ],
      "source": {
        "advisory": "GHSA-wg2q-39h6-66x9",
        "discovery": "UNKNOWN"
      },
      "title": "goshs has a Path Traversal issue"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66063",
    "datePublished": "2026-07-28T22:07:15.558Z",
    "dateReserved": "2026-07-23T23:25:28.897Z",
    "dateUpdated": "2026-07-28T22:07:15.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64863 (GCVE-0-2026-64863)

Vulnerability from cvelistv5 – Published: 2026-07-28 22:02 – Updated: 2026-07-28 22:02

Title

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/0444ac…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:02:15.887Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hq33-8jgp-8qq3",
        "discovery": "UNKNOWN"
      },
      "title": "goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64863",
    "datePublished": "2026-07-28T22:02:15.887Z",
    "dateReserved": "2026-07-20T18:31:39.291Z",
    "dateUpdated": "2026-07-28T22:02:15.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54719 (GCVE-0-2026-54719)

Vulnerability from cvelistv5 – Published: 2026-07-28 21:58 – Updated: 2026-07-29 12:32

Title

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization
CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/7cf911…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: < 2.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54719",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T12:32:34.267762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T12:32:38.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk\u0026file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T22:01:10.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-rmxw-pq4x-3fvh",
        "discovery": "UNKNOWN"
      },
      "title": "goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54719",
    "datePublished": "2026-07-28T21:58:50.208Z",
    "dateReserved": "2026-06-15T23:07:33.231Z",
    "dateUpdated": "2026-07-29T12:32:38.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-62325 (GCVE-0-2026-62325)

Vulnerability from cvelistv5 – Published: 2026-07-28 21:52 – Updated: 2026-07-28 21:52

Title

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/goshs-labs/goshs/security/advi…	x_refsource_CONFIRM
https://github.com/goshs-labs/goshs/commit/32f4a0…	x_refsource_MISC
https://github.com/goshs-labs/goshs/releases/tag/v2.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
goshs-labs	goshs	Affected: >= 2.1.3, < 2.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "goshs",
          "vendor": "goshs-labs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.3, \u003c 2.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != \"\" \u0026\u0026 Password != \"\", so running goshs with -b \u0027admin:\u0027 -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T21:52:05.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a"
        },
        {
          "name": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-rjrw-mjq6-hpmm",
        "discovery": "UNKNOWN"
      },
      "title": "goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62325",
    "datePublished": "2026-07-28T21:52:05.595Z",
    "dateReserved": "2026-07-13T19:27:58.315Z",
    "dateUpdated": "2026-07-28T21:52:05.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities found for goshs by goshs-labs

CVE-2026-66064 (GCVE-0-2026-66064)

CVE-2026-66063 (GCVE-0-2026-66063)

CVE-2026-64863 (GCVE-0-2026-64863)

CVE-2026-62325 (GCVE-0-2026-62325)

CVE-2026-54719 (GCVE-0-2026-54719)

CVE-2026-66064 (GCVE-0-2026-66064)

CVE-2026-66063 (GCVE-0-2026-66063)

CVE-2026-64863 (GCVE-0-2026-64863)

CVE-2026-54719 (GCVE-0-2026-54719)

CVE-2026-62325 (GCVE-0-2026-62325)