CVE-2026-62325CWE-306

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Critical · published July 28, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00589 · 47.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-28T21:52Z
EPSS history
Timeline
  • 28 JUL 21:52Z
    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
    cvelistv5