Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-34581

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

VectorNETWORK

PublishedApr 02, 2026, 19:21

Published Bysecurity-advisories@github.com

Base Score

Score8.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/patrickhener/goshs(Go)1.1.0N/AN/A

References

https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2
https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g

Weakness Type

CWE-288

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK