CVE-2026-62325
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
| CWE | CWE-306 |
| Vendor | goshs-labs |
| Product | goshs |
| Published | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for goshs-labs goshs
Be the first to know when new critical vulnerabilities affecting goshs-labs goshs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
goshs-labs / goshs
>= 2.1.3, < 2.1.4