CVE-2026-34581CWE-288

goshs has Auth Bypass via Share Token

High · published April 2, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-04-02T18:04Z
EPSS history
Timeline
  • 02 APR 18:04Z
    goshs has Auth Bypass via Share Token
    cvelistv5