CVE-2026-62325 Details
Description
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
A vulnerability in the SFTP server component of goshs, a single-binary file server for red teamers and developers, allows for unauthenticated file access. This issue affects goshs versions 2.1.3 prior to 2.1.4. The vulnerability arises because the SFTP password handler was only activated when both a username and password were provided. As a result, running goshs with a specified username and an empty password left the authentication handler unset, enabling unauthenticated access to files via SFTP. This vulnerability exploits the same root cause as CVE-2026-40884, but through a different input method.
Users can upgrade to goshs version 2.1.4, which addresses this vulnerability by ensuring that the SFTP password handler is activated whenever either a username or password is set. Instructions for downloading the latest version are available on the goshs GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a | [email protected] | Source CodeVendor |
| https://github.com/goshs-labs/goshs/releases/tag/v2.1.4 | [email protected] | Release NotesVendor |
| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm | [email protected] | AdvisoryBundleExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs | >v2.1.3, < v2.1.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |