CVE-2026-34581

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34581
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34581.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34581
Aliases
Published
2026-04-02T18:04:35.217Z
Modified
2026-07-08T08:00:19.348319068Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
goshs has Auth Bypass via Share Token
Details

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34581.json"
}
References

Affected packages

Git / github.com/goshs-labs/goshs

Affected ranges

Type
GIT
Repo
https://github.com/goshs-labs/goshs
Events
Introduced
1ae129a5ae4fc0e05875da251e5ba9cf1c7a6db3
Fixed
69d1ae7a3187f098b7ad80723b89270104afff06
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "fixed": "2.0.0-beta.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.3
v1.*
v1.1.0
v1.1.1
v1.1.2
v1.1.4
v2.*
v2.0.0-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34581.json"