{"id":"CVE-2026-40884","sourceIdentifier":"security-advisories@github.com","published":"2026-04-21T20:17:02.107","lastModified":"2026-06-17T10:45:49.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"patrickhener","product":"goshs","versions":[{"version":"< 2.0.0-beta.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-22T13:43:56.178845Z","id":"CVE-2026-40884","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*","versionEndExcluding":"2.0.0","matchCriteriaId":"471EA45E-3052-469D-B301-4D92FB187228"},{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*","matchCriteriaId":"047ECFC3-056F-4FAC-9B64-5F7C120CFFE1"},{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*","matchCriteriaId":"6EA86AD2-EE6D-4427-9434-A9A49A4D38F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*","matchCriteriaId":"F44CF6A3-C1BC-4636-A1D5-1ED69A340FE3"},{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*","matchCriteriaId":"486D1F77-023B-4EB9-8B49-17EF6546F2DF"},{"vulnerable":true,"criteria":"cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*","matchCriteriaId":"5834E73F-2EF9-42BD-BE8B-DE087A19A132"}]}]}],"references":[{"url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}