CVE-2025-46816
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-46816
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46816.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-46816
- Aliases
- Downstream
- Related
- Published
- 2025-05-06T18:41:58Z
- Modified
- 2025-10-16T04:46:05.978639Z
- Severity
-
- 9.4 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- goshs route not protected, allows command execution
- Details
-
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function
dispatchReadPumpdoes not checks the option cli-c, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue. - References