patrickhener goshs vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202614

Newest CVEs

• CVE-2026-50139

  goshs: Share-link ?token=… redemption races past download limit

  patrickhener · goshs

  Medium5.9
• CVE-2026-50138

  goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

  patrickhener · goshs

  High8.1
• CVE-2026-42091

  goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

  patrickhener · goshs

  Medium6.5
• CVE-2026-40903

  Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence

  patrickhener · goshs

  Critical9.1
• CVE-2026-40885

  goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

  patrickhener · goshs

  High7.7
• CVE-2026-40884

  goshs: Empty-username SFTP password authentication bypass in goshs

  patrickhener · goshs

  Critical9.8
• CVE-2026-40883

  goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

  patrickhener · goshs

  Medium6.1
• CVE-2026-40876

  SFTP root escape via prefix-based path validation in goshs

  patrickhener · goshs

  High8.7
• CVE-2026-40189

  goshs has a file-based ACL authorization bypass in goshs state-changing routes

  patrickhener · goshs

  Critical9.3
• CVE-2026-40188

  goshs is Missing Write Protection for Parametric Data Values

  patrickhener · goshs

  High7.7