CVE-2026-62325

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62325
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62325.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62325
Aliases
Published
2026-07-28T21:52:05.595Z
Modified
2026-07-30T04:02:43.437404382Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
Details

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62325.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/goshs-labs/goshs

Affected ranges

Type
GIT
Repo
https://github.com/goshs-labs/goshs
Events
Introduced
ead99b9b5081d473c61743cfed5e8290702317d2
Fixed
32f4a0e1790a709f722d0f3b2341f139d003180a
Fixed
d4e775d5a84d662d426bc19a95d9b990a97d60e4
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.1.3"
        },
        {
            "fixed": "2.1.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62325.json"