CVE-2026-40884 Details
Description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
An authentication bypass vulnerability in the SFTP service of goshs, a SimpleHTTPServer written in Go, has been identified in versions prior to 2.0.0-beta.6. The issue arises when the empty-username basic-auth syntax is used. If the server is started with the empty username and a password, it accepts the configuration but fails to install the necessary SFTP password handler. Consequently, an unauthenticated network attacker can connect to the SFTP service and access files without a password.
Users are advised to update to goshs version 2.0.0-beta.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs goshs | < 2.0.0 2.0.0 beta1 2.0.0 beta2 2.0.0 beta3 2.0.0 beta4 2.0.0 beta5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |