CVE-2026-62325
Critical · 9.1CVSS
9.1
EPSS
0.4%
Published
Jul 28, 2026
CISA due date
—
The record
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63399 Coop is an open source review and moderation tool from ROOST. CWE-306
- CVE-2026-63396 Coop is an open source review and moderation tool from ROOST. CWE-306
- CVE-2026-63377 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-306
- CVE-2026-62863 MoLing is a computer-use and browser-use based MCP server. CWE-306
- CVE-2026-62302 MyTube is a self-hosted downloader and player for several video websites. CWE-306
- CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. CWE-306
- CVE-2026-119705 SerpBear before 3.1.1 contains a missing authentication vulnerability in… CWE-306
- CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-306