CVE-2026-34581

תיאור (מקור, אנגלית)

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

מדדים

CVSS 3.1

8.1 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-27/7/2026

CWE

CWE-288

מוצרים מושפעים

goshs: goshs

קישורים

• https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g ExploitVendor Advisory
• https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb‮… Patch
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2 ProductRelease Notes