{"id":"EUVD-2026-24272","enisaUuid":"55d44ce4-75d3-367c-b99b-cf85d13a6ef1","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b \u0027:pass\u0027 together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.","datePublished":"Apr 21, 2026, 7:39:25 PM","dateUpdated":"Apr 22, 2026, 1:44:15 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv\n","aliases":"CVE-2026-40884\nGHSA-c29w-qq4m-2gcv\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"8f729660-1677-3316-a511-21232f7c42d1","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.0.0-beta.6"}],"enisaIdVendor":[{"id":"d5fe3d65-1496-3b36-9bd6-4b2e791e623b","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"94f070e7-8ef0-302b-a296-a311f815b31f","vulnerability":{"id":"CVE-2026-40884","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b \u0027:pass\u0027 together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.","datePublished":"Apr 21, 2026, 7:39:25 PM","dateUpdated":"Apr 22, 2026, 1:44:15 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv\n","enisa_id":"EUVD-2026-24272\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"a3008a5a-3a9b-32a5-925e-76b7e871973b","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.0.0-beta.6"}],"vulnerabilityVendor":[{"id":"ef2aa48b-8046-36f0-bf70-e086ebb25b8c","vendor":{"name":"patrickhener"}}]}},{"id":"ef7a55c0-066a-3c5b-8d52-f0f394da18fb","vulnerability":{"id":"GHSA-c29w-qq4m-2gcv","description":"goshs has an empty-username SFTP password authentication bypass","datePublished":"Apr 14, 2026, 10:28:30 PM","dateUpdated":"Apr 27, 2026, 4:17:25 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40884\nhttps://github.com/patrickhener/goshs\n","enisa_id":"EUVD-2026-24272\n","aliases":"CVE-2026-40884\nGHSA-c29w-qq4m-2gcv\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}