PT-2026-65623 · Goshs · Goshs

CVE-2026-62325 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions goshs versions 2.1.3 through 2.1.3

Description An authentication bypass exists in the SFTP server component when the application is started with a basic authentication string containing a username but an empty password (e.g., -b 'admin:'), the -sftp flag enabled, and the -fkf flag disabled. The issue stems from the use of a logical AND (&&) operator in the sftpserver/sftpserver.go password handler. If either the username or password is empty, the PasswordHandler is not initialized. When both the PasswordHandler and PublicKeyHandler are unset, the underlying SSH library sets NoClientAuth to true, allowing unauthenticated users to access files, including reading, writing, deleting, and renaming them.

Recommendations Update goshs to version 2.1.4. As a temporary workaround, avoid starting the server with an empty password in the basic authentication string when using SFTP without public key files.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-62325

GHSA-RJRW-MJQ6-HPMM

Affected Products

Goshs

References · 6

• https://osv.dev/vulnerability/GHSA-rjrw-mjq6-hpmm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-62325 · Security Note
• https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a · Note
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm · Note
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.4 · Note
• https://github.com/goshs-labs/goshs · Note