PT-2026-29664 · Goshs · Goshs

Marduc812 · Published 2026-04-01 · Updated 2026-05-02 · CVE-2026-34581

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2

Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code execution. Specifically, the BasicAuthMiddleware incorrectly prioritizes the ?token= parameter check before credential verification. If a valid token exists in SharedLinks, the request bypasses authentication entirely, even if the ?ws (WebSocket) parameter is present. This allows an attacker to access features intended to be restricted, such as directory listing, file deletion, clipboard access, WebSocket connections, and CLI command execution. A proof-of-concept (PoC) demonstrates the ability to execute commands like id and cat /etc/passwd without authentication using a share token.

Recommendations Update goshs to version 2.0.0-beta.2 or later.

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-34581

GHSA-JGFX-74G2-9R6G

Affected Products

Goshs

References · 10

• https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216 · Patch
• https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34581 · Security Note
• https://osv.dev/vulnerability/GHSA-jgfx-74g2-9r6g · Vendor Advisory
• https://github.com/patrickhener/goshs · Note
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2 · Note
• https://twitter.com/infoflowcloud/status/2040130149484511556 · Twitter Post
• https://twitter.com/CVEnew/status/2040128811681882206 · Twitter Post
• https://twitter.com/HugoValters/status/2050622596249505830 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039915959000203292 · Twitter Post