goshs: Empty-username SFTP password authentication bypass in goshs

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

Scores

EPSS (exploitation in 30 days)

0.48% · top 59% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-306: Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs

Affected products

• patrickhener · goshs

  • affected < 2.0.0-beta.6

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/patrickhener/goshsGHSA-c29w-qq4m-2gcv (opens in a new tab)
• Gogithub.com/patrickhener/goshs/v2GHSA-c29w-qq4m-2gcv (opens in a new tab)

References (1)

• https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv (opens in a new tab)x_refsource_CONFIRMexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-c29w-qq4m-2gcv (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-40884](https://trackcve.app/badge/CVE-2026-40884.svg)](https://trackcve.app/cve/CVE-2026-40884)

Record last updated 22 Apr 2026, 13:44 UTC.