CVE-2026-62325

CriticalCVSS 9.1

Published: 28/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

In goshs from version 2.1.3 to 2.1.4, the SFTP password handler only checked that username and password are not empty, so running with -b 'admin:' -sftp and without -fkf left both SFTP authentication handlers unset, allowing unauthenticated file access.

Risk Assessment

An unauthenticated person can access files on the SFTP server, leading to data leakage.

Recommendation

Update goshs to version 2.1.4 or later.

Original NVD description (English source)

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.